@floatingsidewal/bulkhead-core 0.3.0

package/dist/index.js

@@ -0,0 +1,3470 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  BUILTIN_POLICIES: () => BUILTIN_POLICIES,
+  BaseGuard: () => BaseGuard,
+  DEFAULT_CONFIG: () => DEFAULT_CONFIG2,
+  GuardrailsEngine: () => GuardrailsEngine,
+  InjectionGuard: () => InjectionGuard,
+  LeakageGuard: () => LeakageGuard,
+  PiiGuard: () => PiiGuard,
+  SecretGuard: () => SecretGuard,
+  TestDataGuard: () => TestDataGuard,
+  assessRisk: () => assessRisk,
+  createEngine: () => createEngine,
+  getPolicy: () => getPolicy,
+  policyToEngineConfig: () => policyToEngineConfig,
+  resolvePolicy: () => resolvePolicy
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/cascade/bert-layer.ts
+var import_node_worker_threads = require("worker_threads");
+var import_node_path = require("path");
+var import_node_fs = require("fs");
+var DEFAULT_MODEL_ID = "Xenova/bert-base-NER";
+var BertLayer = class {
+  worker = null;
+  pendingRequests = /* @__PURE__ */ new Map();
+  requestId = 0;
+  config;
+  /** Whether the BERT model has been loaded and first inference completed */
+  _loaded = false;
+  get loaded() {
+    return this._loaded;
+  }
+  constructor(config) {
+    this.config = {
+      escalationThreshold: 0.75,
+      ...config
+    };
+  }
+  /** Resolve the worker path — supports both compiled .js and source .ts */
+  resolveWorkerPath() {
+    const compiledPath = (0, import_node_path.resolve)(__dirname, "cascade", "bert-worker.js");
+    if ((0, import_node_fs.existsSync)(compiledPath)) return compiledPath;
+    const tsPath = (0, import_node_path.resolve)(__dirname, "bert-worker.ts");
+    if ((0, import_node_fs.existsSync)(tsPath)) return tsPath;
+    return compiledPath;
+  }
+  /** Ensure the worker thread is running */
+  ensureWorker() {
+    if (!this.worker) {
+      const workerPath = this.resolveWorkerPath();
+      const isTs = workerPath.endsWith(".ts");
+      this.worker = isTs ? new import_node_worker_threads.Worker(workerPath, {
+        execArgv: ["--require", "tsx/cjs"]
+      }) : new import_node_worker_threads.Worker(workerPath);
+      this.worker.on("message", (msg) => {
+        const pending = this.pendingRequests.get(msg.id);
+        if (!pending) return;
+        this.pendingRequests.delete(msg.id);
+        if (msg.type === "error") {
+          pending.reject(new Error(msg.error ?? "Unknown worker error"));
+        } else {
+          pending.resolve(msg.tokens ?? []);
+        }
+      });
+      this.worker.on("error", (err) => {
+        for (const [id, pending] of this.pendingRequests) {
+          pending.reject(err);
+          this.pendingRequests.delete(id);
+        }
+      });
+    }
+    return this.worker;
+  }
+  /** Send text to the BERT worker and get raw token results */
+  async analyzeRaw(text) {
+    const worker = this.ensureWorker();
+    const id = String(++this.requestId);
+    return new Promise((resolve2, reject) => {
+      this.pendingRequests.set(id, { resolve: resolve2, reject });
+      worker.postMessage({
+        type: "analyze",
+        id,
+        text,
+        modelId: this.config.modelId ?? DEFAULT_MODEL_ID
+      });
+    });
+  }
+  /**
+   * Analyze text and return Detection objects with escalation disposition.
+   * Tokens above the escalation threshold are "confirmed",
+   * tokens below are "escalate" (need LLM review).
+   */
+  async analyze(text) {
+    const tokens = await this.analyzeRaw(text);
+    this._loaded = true;
+    return tokens.map((token) => {
+      const entityType = token.entity.replace(/^[BI]-/, "");
+      const isConfirmed = token.score >= this.config.escalationThreshold;
+      const confidence = token.score >= 0.9 ? "high" : token.score >= 0.7 ? "medium" : "low";
+      return {
+        entityType,
+        start: token.start,
+        end: token.end,
+        text: token.word,
+        confidence,
+        score: token.score,
+        guardName: "cascade-bert",
+        source: "bert",
+        context: text.slice(
+          Math.max(0, token.start - 150),
+          Math.min(text.length, token.end + 150)
+        ),
+        disposition: isConfirmed ? "confirmed" : "escalate"
+      };
+    });
+  }
+  /** Terminate the worker thread */
+  async dispose() {
+    if (this.worker) {
+      await this.worker.terminate();
+      this.worker = null;
+      this.pendingRequests.clear();
+    }
+  }
+};
+
+// src/cascade/llm-layer.ts
+var LlmLayer = class {
+  config;
+  constructor(config) {
+    this.config = {
+      contextSentences: 3,
+      ...config
+    };
+  }
+  /** Set the LLM provider (can be swapped at runtime) */
+  setProvider(provider) {
+    this.config.provider = provider;
+  }
+  /**
+   * Disambiguate escalated detections using an LLM.
+   * @param escalated Detections with disposition "escalate"
+   * @param fullText The full document text
+   * @param confirmed Already-confirmed detections (passed as context to help disambiguation)
+   */
+  async disambiguate(escalated, fullText, confirmed) {
+    if (!this.config.provider) {
+      return escalated;
+    }
+    const results = [];
+    for (const detection of escalated) {
+      const prompt = this.buildPrompt(detection, fullText, confirmed);
+      try {
+        const response = await this.config.provider(prompt);
+        const parsed = this.parseResponse(response);
+        if (parsed && parsed.type !== "NONE") {
+          results.push({
+            ...detection,
+            entityType: parsed.type,
+            score: parsed.confidence,
+            confidence: parsed.confidence >= 0.9 ? "high" : parsed.confidence >= 0.7 ? "medium" : "low",
+            source: "llm",
+            disposition: "confirmed"
+          });
+        } else {
+          results.push({
+            ...detection,
+            source: "llm",
+            disposition: "dismissed"
+          });
+        }
+      } catch {
+        results.push(detection);
+      }
+    }
+    return results;
+  }
+  /** Build a focused disambiguation prompt */
+  buildPrompt(detection, fullText, confirmed) {
+    const contextWindow = this.extractSentenceContext(
+      fullText,
+      detection.start,
+      detection.end
+    );
+    const confirmedList = confirmed.filter((d) => d.disposition === "confirmed").map((d) => `${d.text} (${d.entityType})`).slice(0, 10);
+    return `You are a PII detection system. Determine if the highlighted span is personally identifiable information.
+
+Context: "${contextWindow}"
+Span: "${detection.text}"
+BERT suggested: ${detection.entityType} (confidence: ${detection.score.toFixed(2)})
+${confirmedList.length > 0 ? `Other confirmed entities in document: [${confirmedList.join(", ")}]` : ""}
+
+Is this span PII? If yes, what type? If it's ambiguous (e.g., "Jordan" could be a person or country), use the context to decide.
+
+Respond with ONLY a JSON object: { "type": "PERSON"|"LOCATION"|"ORGANIZATION"|"NONE", "confidence": 0.0-1.0 }`;
+  }
+  /** Extract ±N sentences around a span */
+  extractSentenceContext(text, start, end) {
+    const n = this.config.contextSentences;
+    const sentenceBreaks = [0];
+    const sentenceRegex = /[.!?]+\s+/g;
+    let match;
+    while ((match = sentenceRegex.exec(text)) !== null) {
+      sentenceBreaks.push(match.index + match[0].length);
+    }
+    sentenceBreaks.push(text.length);
+    let spanSentenceIdx = 0;
+    for (let i = 0; i < sentenceBreaks.length - 1; i++) {
+      if (sentenceBreaks[i] <= start && start < sentenceBreaks[i + 1]) {
+        spanSentenceIdx = i;
+        break;
+      }
+    }
+    const contextStart = sentenceBreaks[Math.max(0, spanSentenceIdx - n)];
+    const contextEnd = sentenceBreaks[Math.min(sentenceBreaks.length - 1, spanSentenceIdx + n + 1)];
+    return text.slice(contextStart, contextEnd).trim();
+  }
+  /** Parse the LLM response JSON */
+  parseResponse(response) {
+    try {
+      const jsonMatch = response.match(/\{[^}]+\}/);
+      if (!jsonMatch) return null;
+      const parsed = JSON.parse(jsonMatch[0]);
+      if (typeof parsed.type === "string" && typeof parsed.confidence === "number") {
+        return parsed;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+};
+
+// src/cascade/cascade.ts
+var DEFAULT_CASCADE_CONFIG = {
+  escalationThreshold: 0.75,
+  contextSentences: 3,
+  bertEnabled: true,
+  llmEnabled: false,
+  modelId: "Xenova/bert-base-NER"
+};
+var CascadeClassifier = class {
+  config;
+  bertLayer = null;
+  llmLayer;
+  regexGuards = [];
+  constructor(config) {
+    this.config = { ...DEFAULT_CASCADE_CONFIG, ...config };
+    this.llmLayer = new LlmLayer({
+      contextSentences: this.config.contextSentences,
+      provider: this.config.llmProvider
+    });
+  }
+  /** Whether the cascade is ready to serve (BERT model loaded if enabled) */
+  get ready() {
+    if (!this.config.bertEnabled) return true;
+    if (!this.bertLayer) return true;
+    return this.bertLayer.loaded;
+  }
+  /** Register regex-based guards (Layer 1) */
+  addRegexGuard(guard) {
+    this.regexGuards.push(guard);
+    return this;
+  }
+  /** Set the LLM provider for Layer 3 */
+  setLlmProvider(provider) {
+    this.config.llmProvider = provider;
+    this.llmLayer.setProvider(provider);
+  }
+  /**
+   * Run the full cascade: Regex → BERT → LLM
+   * Returns a unified GuardResult with all detections carrying provenance.
+   */
+  async deepScan(text) {
+    const regexDetections = await this.runRegexLayer(text);
+    if (!this.config.bertEnabled) {
+      return this.buildCascadeResult(text, regexDetections);
+    }
+    const bertDetections = await this.runBertLayer(text);
+    const mergedBert = this.deduplicateAgainstRegex(
+      bertDetections,
+      regexDetections
+    );
+    const allDetections = [...regexDetections, ...mergedBert];
+    const escalated = allDetections.filter((d) => d.disposition === "escalate");
+    if (!this.config.llmEnabled || escalated.length === 0 || !this.config.llmProvider) {
+      return this.buildCascadeResult(text, allDetections);
+    }
+    const confirmed = allDetections.filter((d) => d.disposition === "confirmed");
+    const resolved = await this.llmLayer.disambiguate(
+      escalated,
+      text,
+      confirmed
+    );
+    const finalDetections = [
+      ...allDetections.filter((d) => d.disposition !== "escalate"),
+      ...resolved
+    ];
+    return this.buildCascadeResult(text, finalDetections);
+  }
+  /** Run Layer 1 only (for fast auto-scan path) */
+  async regexScan(text) {
+    const detections = await this.runRegexLayer(text);
+    return this.buildCascadeResult(text, detections);
+  }
+  /** Run Layers 1 + 2 only (no LLM, for "Scan File" command) */
+  async modelScan(text) {
+    const regexDetections = await this.runRegexLayer(text);
+    if (!this.config.bertEnabled) {
+      return this.buildCascadeResult(text, regexDetections);
+    }
+    const bertDetections = await this.runBertLayer(text);
+    const mergedBert = this.deduplicateAgainstRegex(
+      bertDetections,
+      regexDetections
+    );
+    return this.buildCascadeResult(text, [...regexDetections, ...mergedBert]);
+  }
+  // --- Private methods ---
+  async runRegexLayer(text) {
+    const allDetections = [];
+    for (const guard of this.regexGuards) {
+      const result = await guard.analyze(text);
+      allDetections.push(...result.detections);
+    }
+    return allDetections;
+  }
+  async runBertLayer(text) {
+    if (!this.bertLayer) {
+      this.bertLayer = new BertLayer({
+        modelId: this.config.modelId,
+        escalationThreshold: this.config.escalationThreshold
+      });
+    }
+    return this.bertLayer.analyze(text);
+  }
+  /** Remove BERT detections that overlap with regex detections */
+  deduplicateAgainstRegex(bertDetections, regexDetections) {
+    return bertDetections.filter((bert) => {
+      return !regexDetections.some(
+        (regex) => bert.start < regex.end && bert.end > regex.start
+      );
+    });
+  }
+  buildCascadeResult(text, detections) {
+    const activeDetections = detections.filter(
+      (d) => d.disposition !== "dismissed"
+    );
+    const passed = activeDetections.length === 0;
+    const score = activeDetections.length > 0 ? Math.max(...activeDetections.map((d) => d.score)) : 0;
+    const sources = [...new Set(detections.map((d) => d.source))];
+    const types = [...new Set(activeDetections.map((d) => d.entityType))];
+    return {
+      passed,
+      reason: passed ? "No issues detected" : `Detected via ${sources.join("+")}: ${types.join(", ")}`,
+      guardName: "cascade",
+      score,
+      detections
+    };
+  }
+  /** Clean up resources */
+  async dispose() {
+    if (this.bertLayer) {
+      await this.bertLayer.dispose();
+      this.bertLayer = null;
+    }
+  }
+};
+
+// src/policy/risk.ts
+function assessRisk(results, policy) {
+  const allDetections = results.flatMap((r) => r.detections);
+  const testDetections = allDetections.filter(
+    (d) => d.entityType.startsWith("TEST_DATA_")
+  );
+  const realDetections = allDetections.filter(
+    (d) => !d.entityType.startsWith("TEST_DATA_")
+  );
+  const testDataFlags = testDetections.map((d) => ({
+    value: d.text,
+    reason: d.entityType.toLowerCase().replace("test_data_", "") + "-pattern",
+    start: d.start,
+    end: d.end
+  }));
+  const score = realDetections.length > 0 ? Math.max(...realDetections.map((d) => d.score)) : 0;
+  const level = scoreToLevel(score, policy.riskThresholds);
+  const guards = {};
+  for (const result of results) {
+    if (result.guardName === "testdata") continue;
+    const guardDetections = result.detections.filter(
+      (d) => !d.entityType.startsWith("TEST_DATA_")
+    );
+    guards[result.guardName] = {
+      level: scoreToLevel(result.score, policy.riskThresholds),
+      score: result.score,
+      detectionCount: guardDetections.length
+    };
+  }
+  const issues = classifyIssues(realDetections, testDetections, policy);
+  return { level, score, guards, issues, testDataFlags };
+}
+function scoreToLevel(score, thresholds) {
+  if (score >= thresholds.critical) return "critical";
+  if (score >= thresholds.high) return "high";
+  if (score >= thresholds.medium) return "medium";
+  if (score >= thresholds.low) return "low";
+  return "none";
+}
+function classifyIssues(realDetections, testDetections, policy) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const d of realDetections) {
+    const key = `${d.guardName}:${d.entityType}`;
+    const group = groups.get(key);
+    if (group) {
+      group.detections.push(d);
+    } else {
+      groups.set(key, {
+        detections: [d],
+        guardName: d.guardName,
+        entityType: d.entityType
+      });
+    }
+  }
+  const issues = [];
+  for (const [, group] of groups) {
+    const maxScore = Math.max(...group.detections.map((d) => d.score));
+    const severity = scoreToLevel(maxScore, policy.riskThresholds);
+    const isTestData = group.detections.some(
+      (d) => testDetections.some(
+        (td) => d.start < td.end && d.end > td.start
+      )
+    );
+    const category = guardNameToCategory(group.guardName);
+    const sample = group.detections[0]?.text?.slice(0, 50);
+    issues.push({
+      category,
+      entityType: group.entityType,
+      severity,
+      count: group.detections.length,
+      isTestData,
+      sample
+    });
+  }
+  return issues.sort((a, b) => {
+    const levelOrder = {
+      critical: 0,
+      high: 1,
+      medium: 2,
+      low: 3,
+      none: 4
+    };
+    const levelDiff = levelOrder[a.severity] - levelOrder[b.severity];
+    if (levelDiff !== 0) return levelDiff;
+    return b.count - a.count;
+  });
+}
+function guardNameToCategory(guardName) {
+  switch (guardName) {
+    case "pii":
+      return "pii";
+    case "secret":
+      return "secret";
+    case "injection":
+      return "injection";
+    case "leakage":
+      return "leakage";
+    default:
+      return "pii";
+  }
+}
+
+// src/engine/engine.ts
+var GuardrailsEngine = class {
+  guards = [];
+  config;
+  cascade = null;
+  constructor(config) {
+    this.config = {
+      guards: {},
+      ...config
+    };
+  }
+  /** Register a guard with the engine */
+  addGuard(guard) {
+    this.guards.push(guard);
+    return this;
+  }
+  /** Register multiple guards */
+  addGuards(guards) {
+    for (const guard of guards) {
+      this.addGuard(guard);
+    }
+    return this;
+  }
+  /** Get configuration for a specific guard */
+  getGuardConfig(guardName) {
+    return this.config.guards[guardName];
+  }
+  /** Run all enabled guards against the input text */
+  async analyze(text) {
+    const results = [];
+    for (const guard of this.guards) {
+      const guardConfig = this.getGuardConfig(guard.name);
+      if (guardConfig?.enabled === false) {
+        continue;
+      }
+      const result = await guard.analyze(text, guardConfig);
+      results.push(result);
+    }
+    return results;
+  }
+  /** Run all guards and return a single pass/fail with all detections */
+  async scan(text) {
+    const results = await this.analyze(text);
+    const passed = results.every((r) => r.passed);
+    let redactedText;
+    for (const result of results) {
+      if (result.redactedText) {
+        redactedText = result.redactedText;
+      }
+    }
+    return { passed, results, redactedText };
+  }
+  /** Get list of registered guard names */
+  get guardNames() {
+    return this.guards.map((g) => g.name);
+  }
+  /** Whether the cascade is ready (BERT model loaded if enabled) */
+  get cascadeReady() {
+    if (!this.cascade) return true;
+    return this.cascade.ready;
+  }
+  /** Initialize or update the cascade classifier */
+  initCascade(config) {
+    this.cascade = new CascadeClassifier(config);
+    for (const guard of this.guards) {
+      this.cascade.addRegexGuard(guard);
+    }
+    return this.cascade;
+  }
+  /** Run the full cascade (regex + BERT + optional LLM) */
+  async deepScan(text) {
+    if (!this.cascade) {
+      return this.analyze(text);
+    }
+    const cascadeResult = await this.cascade.deepScan(text);
+    return [cascadeResult];
+  }
+  /** Run regex + BERT only (no LLM) */
+  async modelScan(text) {
+    if (!this.cascade) {
+      return this.analyze(text);
+    }
+    const cascadeResult = await this.cascade.modelScan(text);
+    return [cascadeResult];
+  }
+  /** Update engine configuration */
+  updateConfig(config) {
+    this.config = { ...this.config, ...config };
+    if (config.guards) {
+      this.config.guards = { ...this.config.guards, ...config.guards };
+    }
+  }
+  /** Run all guards and return risk assessment alongside results */
+  async policyScan(text, policy) {
+    const { passed, results, redactedText } = await this.scan(text);
+    const risk = assessRisk(results, policy);
+    return { passed, risk, results, redactedText };
+  }
+  /** Clean up resources (terminate BERT worker, etc.) */
+  async dispose() {
+    if (this.cascade) {
+      await this.cascade.dispose();
+      this.cascade = null;
+    }
+  }
+};
+
+// src/guards/base.guard.ts
+var CONTEXT_RADIUS = 150;
+var DEFAULT_CONFIG = {
+  enabled: true,
+  threshold: 0.5,
+  mode: "redact"
+};
+var BaseGuard = class {
+  mergeConfig(config) {
+    return { ...DEFAULT_CONFIG, ...config };
+  }
+  /** Build a GuardResult from detections */
+  buildResult(text, detections, mode) {
+    const passed = detections.length === 0;
+    const score = detections.length > 0 ? Math.max(...detections.map((d) => d.score)) : 0;
+    let reason;
+    if (passed) {
+      reason = "No issues detected";
+    } else {
+      const types = [...new Set(detections.map((d) => d.entityType))];
+      reason = `Detected: ${types.join(", ")}`;
+    }
+    const result = {
+      passed,
+      reason,
+      guardName: this.name,
+      score,
+      detections
+    };
+    if (mode === "redact" && !passed) {
+      result.redactedText = this.applyRedactions(text, detections);
+    }
+    return result;
+  }
+  /** Extract surrounding context for a detection */
+  extractContext(text, start, end) {
+    const ctxStart = Math.max(0, start - CONTEXT_RADIUS);
+    const ctxEnd = Math.min(text.length, end + CONTEXT_RADIUS);
+    return text.slice(ctxStart, ctxEnd);
+  }
+  /** Create a detection with provenance fields pre-filled for regex source */
+  makeDetection(text, partial, source = "regex", disposition = "confirmed") {
+    return {
+      ...partial,
+      source,
+      context: this.extractContext(text, partial.start, partial.end),
+      disposition
+    };
+  }
+  /** Replace detected text with [REDACTED-TYPE] markers */
+  applyRedactions(text, detections) {
+    const sorted = [...detections].sort((a, b) => b.start - a.start);
+    let result = text;
+    for (const detection of sorted) {
+      const replacement = `[REDACTED-${detection.entityType}]`;
+      result = result.slice(0, detection.start) + replacement + result.slice(detection.end);
+    }
+    return result;
+  }
+};
+
+// src/validators/checksums.ts
+function luhn(value) {
+  const digits = value.replace(/\D/g, "");
+  if (digits.length === 0) return false;
+  let sum = 0;
+  let alternate = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let n = parseInt(digits[i], 10);
+    if (alternate) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    alternate = !alternate;
+  }
+  return sum % 10 === 0;
+}
+function ibanMod97(iban) {
+  const cleaned = iban.replace(/[\s-]/g, "").toUpperCase();
+  if (cleaned.length < 4) return false;
+  const rearranged = cleaned.slice(4) + cleaned.slice(0, 4);
+  let numeric = "";
+  for (const char of rearranged) {
+    const code = char.charCodeAt(0);
+    if (code >= 65 && code <= 90) {
+      numeric += (code - 55).toString();
+    } else {
+      numeric += char;
+    }
+  }
+  let remainder = 0;
+  for (const char of numeric) {
+    remainder = (remainder * 10 + parseInt(char, 10)) % 97;
+  }
+  return remainder === 1;
+}
+function abaRouting(value) {
+  const digits = value.replace(/\D/g, "");
+  if (digits.length !== 9) return false;
+  const weights = [3, 7, 1, 3, 7, 1, 3, 7, 1];
+  let sum = 0;
+  for (let i = 0; i < 9; i++) {
+    sum += parseInt(digits[i], 10) * weights[i];
+  }
+  return sum % 10 === 0;
+}
+function npiLuhn(value) {
+  const digits = value.replace(/\D/g, "");
+  if (digits.length !== 10) return false;
+  const prefixed = "80840" + digits;
+  const nums = prefixed.split("").map(Number);
+  let checksum = 0;
+  for (let i = nums.length - 1; i >= 0; i--) {
+    const pos = nums.length - 1 - i;
+    let n = nums[i];
+    if (pos % 2 === 1) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    checksum += n;
+  }
+  return checksum % 10 === 0;
+}
+function deaChecksum(value) {
+  const cleaned = value.replace(/[\s-]/g, "");
+  if (cleaned.length < 3) return false;
+  const numericPart = cleaned.slice(2);
+  const digits = numericPart.split("").map(Number);
+  if (digits.some(isNaN)) return false;
+  const check = digits.pop();
+  const even = digits.filter((_, i) => i % 2 === 0);
+  const odd = digits.filter((_, i) => i % 2 === 1);
+  const sum = 2 * even.reduce((a, b) => a + b, 0) + odd.reduce((a, b) => a + b, 0);
+  return (sum - check) % 10 === 0;
+}
+function shannonEntropy(value) {
+  if (value.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const char of value) {
+    freq.set(char, (freq.get(char) || 0) + 1);
+  }
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / value.length;
+    if (p > 0) {
+      entropy -= p * Math.log2(p);
+    }
+  }
+  return entropy;
+}
+function validateSsn(value) {
+  const digits = value.replace(/\D/g, "");
+  if (digits.length !== 9) return false;
+  if (digits.split("").every((c) => c === digits[0])) return false;
+  if (digits.slice(3, 5) === "00") return false;
+  if (digits.slice(5) === "0000") return false;
+  const invalidPrefixes = ["000", "666", "123456789", "98765432", "078051120"];
+  for (const prefix of invalidPrefixes) {
+    if (digits.startsWith(prefix)) return false;
+  }
+  if (digits[0] === "9") return false;
+  return true;
+}
+function validateMac(value) {
+  const cleaned = value.replace(/[:\-.]/g, "").toUpperCase();
+  if (!/^[0-9A-F]{12}$/.test(cleaned)) return false;
+  if (cleaned === "FFFFFFFFFFFF") return false;
+  if (cleaned === "000000000000") return false;
+  return true;
+}
+
+// src/patterns/pii/generic.ts
+var CREDIT_CARD = {
+  entityType: "CREDIT_CARD",
+  patterns: [
+    /\b(?!1\d{12}(?!\d))((4\d{3})|(5[0-5]\d{2})|(6\d{3})|(1\d{3})|(3\d{3}))[- ]?(\d{3,4})[- ]?(\d{3,4})[- ]?(\d{3,5})\b/g
+  ],
+  validate: (match) => luhn(match.replace(/[\s-]/g, "")),
+  contextWords: [
+    "credit",
+    "card",
+    "visa",
+    "mastercard",
+    "cc",
+    "amex",
+    "discover",
+    "jcb",
+    "diners",
+    "maestro",
+    "instapayment"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.3
+};
+var EMAIL_ADDRESS = {
+  entityType: "EMAIL_ADDRESS",
+  patterns: [
+    /\b(?:[a-zA-Z0-9!#$%&'*+\-/=?^_`{|}~](?:[a-zA-Z0-9!#$%&'*+\-/=?^_`{|}~.]{0,62}[a-zA-Z0-9!#$%&'*+\-/=?^_`{|}~])?)@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}\b/g
+  ],
+  contextWords: ["email", "e-mail", "mail"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var IBAN_CODE = {
+  entityType: "IBAN_CODE",
+  patterns: [
+    /(?<![A-Z0-9])([A-Z]{2}[0-9]{2}(?:[ -]?[A-Z0-9]{4}){2,7}(?:[ -]?[A-Z0-9]{1,4})?)(?![A-Z0-9])/g
+  ],
+  validate: (match) => ibanMod97(match),
+  contextWords: ["iban", "bank", "transaction"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var IP_ADDRESS = {
+  entityType: "IP_ADDRESS",
+  patterns: [
+    // IPv4
+    /\b(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g,
+    // IPv6 (simplified — common formats)
+    /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g,
+    /\b(?:[0-9a-fA-F]{1,4}:){1,7}:\b/g,
+    /\b(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}\b/g
+  ],
+  contextWords: ["ip", "ipv4", "ipv6", "address"],
+  baseConfidence: "medium",
+  baseScore: 0.6
+};
+var MAC_ADDRESS = {
+  entityType: "MAC_ADDRESS",
+  patterns: [
+    // Colon or hyphen separated
+    /\b[0-9A-Fa-f]{2}([:-])(?:[0-9A-Fa-f]{2}\1){4}[0-9A-Fa-f]{2}\b/g,
+    // Cisco dot format
+    /\b[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}\b/g
+  ],
+  validate: validateMac,
+  contextWords: [
+    "mac",
+    "mac address",
+    "hardware address",
+    "physical address",
+    "ethernet"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.6
+};
+var PHONE_NUMBER = {
+  entityType: "PHONE_NUMBER",
+  patterns: [
+    // International format
+    /\b\+?1?[\s.-]?\(?\d{3}\)?[\s.-]?\d{3}[\s.-]?\d{4}\b/g,
+    // International with country code
+    /\b\+\d{1,3}[\s.-]?\(?\d{1,4}\)?[\s.-]?\d{2,4}[\s.-]?\d{2,4}[\s.-]?\d{0,4}\b/g
+  ],
+  contextWords: [
+    "phone",
+    "number",
+    "telephone",
+    "cell",
+    "cellphone",
+    "mobile",
+    "call",
+    "tel",
+    "fax"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.4
+};
+var URL = {
+  entityType: "URL",
+  patterns: [
+    /\bhttps?:\/\/[^\s<>"']+/gi,
+    /\bwww\.[^\s<>"']+/gi
+  ],
+  contextWords: ["url", "website", "link", "href"],
+  baseConfidence: "medium",
+  baseScore: 0.6
+};
+var CRYPTO = {
+  entityType: "CRYPTO",
+  patterns: [
+    // Bitcoin addresses (P2PKH, P2SH, Bech32)
+    /(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,59}/g
+  ],
+  contextWords: ["wallet", "btc", "bitcoin", "crypto", "blockchain"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var DATE_TIME = {
+  entityType: "DATE_TIME",
+  patterns: [
+    // ISO 8601
+    /\b\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d(?:\.\d+)?(?:[+-][0-2]\d:[0-5]\d|Z)\b/g,
+    // mm/dd/yyyy or dd/mm/yyyy
+    /\b(?:[0-3]?\d[/.-][0-3]?\d[/.-](?:\d{4}|\d{2}))\b/g,
+    // yyyy-mm-dd
+    /\b\d{4}[/.-](?:0?[1-9]|1[0-2])[/.-](?:0?[1-9]|[12]\d|3[01])\b/g
+  ],
+  contextWords: ["date", "birthday", "born", "dob"],
+  baseConfidence: "low",
+  baseScore: 0.3
+};
+var GENERIC_PATTERNS = [
+  CREDIT_CARD,
+  EMAIL_ADDRESS,
+  IBAN_CODE,
+  IP_ADDRESS,
+  MAC_ADDRESS,
+  PHONE_NUMBER,
+  URL,
+  CRYPTO,
+  DATE_TIME
+];
+
+// src/patterns/pii/us.ts
+var US_SSN = {
+  entityType: "US_SSN",
+  patterns: [
+    // SSN with delimiters (medium confidence)
+    /\b(\d{3})[- .](\d{2})[- .](\d{4})\b/g,
+    // SSN without delimiters (very weak — needs context)
+    /\b\d{9}\b/g
+  ],
+  validate: validateSsn,
+  contextWords: ["social", "security", "ssn", "ssns", "ssid"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var US_DRIVER_LICENSE = {
+  entityType: "US_DRIVER_LICENSE",
+  patterns: [
+    // State-specific alphanumeric formats
+    /\b(?:[A-Z]\d{3,6}|[A-Z]\d{5,9}|[A-Z]\d{6,8}|[A-Z]\d{4,8}|[A-Z]\d{9,11}|[A-Z]{1,2}\d{5,6}|H\d{8}|V\d{6}|X\d{8}|[A-Z]{2}\d{2,5}|[A-Z]{2}\d{3,7}|\d{2}[A-Z]{3}\d{5,6}|[A-Z]\d{13,14}|[A-Z]\d{18}|[A-Z]\d{6}R|[A-Z]\d{9}|[A-Z]\d{1,12}|\d{9}[A-Z]|[A-Z]{2}\d{6}[A-Z]|\d{8}[A-Z]{2}|\d{3}[A-Z]{2}\d{4}|[A-Z]\d[A-Z]\d[A-Z]|\d{7,8}[A-Z])\b/g
+  ],
+  contextWords: [
+    "driver",
+    "license",
+    "permit",
+    "lic",
+    "identification",
+    "dls",
+    "cdls",
+    "driving"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.3
+};
+var US_PASSPORT = {
+  entityType: "US_PASSPORT",
+  patterns: [
+    // Next generation passport (letter + 8 digits)
+    /\b[A-Z]\d{8}\b/g,
+    // Standard passport (9 digits)
+    /\b\d{9}\b/g
+  ],
+  contextWords: [
+    "us",
+    "united",
+    "states",
+    "passport",
+    "travel",
+    "document"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var US_BANK_NUMBER = {
+  entityType: "US_BANK_NUMBER",
+  patterns: [/\b\d{8,17}\b/g],
+  contextWords: [
+    "check",
+    "account",
+    "acct",
+    "bank",
+    "save",
+    "debit",
+    "routing"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.05
+};
+var US_ITIN = {
+  entityType: "US_ITIN",
+  patterns: [
+    // With delimiters (medium)
+    /\b9\d{2}[- ](5\d|6[0-5]|7\d|8[0-8]|9[0-24-9])[- ]\d{4}\b/g,
+    // Without delimiters (weak)
+    /\b9\d{2}(5\d|6[0-5]|7\d|8[0-8]|9[0-24-9])\d{4}\b/g
+  ],
+  contextWords: [
+    "individual",
+    "taxpayer",
+    "itin",
+    "tax",
+    "payer",
+    "taxid",
+    "tin"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var US_MBI = {
+  entityType: "US_MBI",
+  patterns: (() => {
+    const A = "[ACDEFGHJKMNPQRTUVWXY]";
+    const AN = "[0-9ACDEFGHJKMNPQRTUVWXY]";
+    const N = "[0-9]";
+    const base = `${N}${A}${AN}${N}${A}${AN}${N}${A}${A}${N}${N}`;
+    const withDash = `${N}${A}${AN}${N}-${A}${AN}${N}-${A}${A}${N}${N}`;
+    return [new RegExp(`\\b${base}\\b`, "g"), new RegExp(`\\b${withDash}\\b`, "g")];
+  })(),
+  contextWords: [
+    "medicare",
+    "mbi",
+    "beneficiary",
+    "cms",
+    "medicaid",
+    "hic",
+    "hicn"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var US_NPI = {
+  entityType: "US_NPI",
+  patterns: [
+    // With delimiters
+    /\b[12]\d{3}[ -]\d{3}[ -]\d{3}\b/g,
+    // Without delimiters
+    /\b[12]\d{9}\b/g
+  ],
+  validate: (match) => {
+    const digits = match.replace(/\D/g, "");
+    if (digits.length > 1 && new Set(digits.slice(0, -1)).size === 1) return false;
+    return npiLuhn(match);
+  },
+  contextWords: [
+    "npi",
+    "national provider",
+    "provider",
+    "provider id",
+    "provider identifier",
+    "taxonomy"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var ABA_ROUTING_NUMBER = {
+  entityType: "ABA_ROUTING_NUMBER",
+  patterns: [
+    // With dashes
+    /\b[0123678]\d{3}-\d{4}-\d\b/g,
+    // Without dashes
+    /\b[0123678]\d{8}\b/g
+  ],
+  validate: abaRouting,
+  contextWords: [
+    "aba",
+    "routing",
+    "abarouting",
+    "association",
+    "bankrouting"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.05
+};
+var MEDICAL_LICENSE = {
+  entityType: "MEDICAL_LICENSE",
+  patterns: [
+    /[abcdefghjklmprstuxABCDEFGHJKLMPRSTUX][a-zA-Z]\d{7}/g,
+    /[abcdefghjklmprstuxABCDEFGHJKLMPRSTUX]9\d{7}/g
+  ],
+  validate: deaChecksum,
+  contextWords: ["medical", "certificate", "DEA", "dea"],
+  baseConfidence: "low",
+  baseScore: 0.4
+};
+var US_PATTERNS = [
+  US_SSN,
+  US_DRIVER_LICENSE,
+  US_PASSPORT,
+  US_BANK_NUMBER,
+  US_ITIN,
+  US_MBI,
+  US_NPI,
+  ABA_ROUTING_NUMBER,
+  MEDICAL_LICENSE
+];
+
+// src/patterns/pii/uk.ts
+var UK_NHS = {
+  entityType: "UK_NHS",
+  patterns: [/\b(\d{3})[- ]?(\d{3})[- ]?(\d{4})\b/g],
+  validate: (match) => {
+    const digits = match.replace(/\D/g, "");
+    if (digits.length !== 10) return false;
+    let total = 0;
+    for (let i = 0; i < 10; i++) {
+      total += parseInt(digits[i], 10) * (10 - i);
+    }
+    return total % 11 === 0;
+  },
+  contextWords: [
+    "national health service",
+    "nhs",
+    "health services authority",
+    "health authority"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var UK_NINO = {
+  entityType: "UK_NINO",
+  patterns: [
+    /\b(?!BG|GB|NK|KN|NT|TN|ZZ)(?:[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z])\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b/gi
+  ],
+  contextWords: ["national insurance", "ni number", "nino"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var UK_PASSPORT = {
+  entityType: "UK_PASSPORT",
+  patterns: [/\b[A-Z]{2}\d{7}\b/g],
+  contextWords: [
+    "passport",
+    "passport number",
+    "travel document",
+    "uk passport",
+    "british passport",
+    "her majesty",
+    "his majesty",
+    "hm passport",
+    "hmpo"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var UK_POSTCODE = {
+  entityType: "UK_POSTCODE",
+  patterns: [
+    /\b(?:GIR\s?0AA|[A-PR-UWYZ]\d[A-HJKPSTUW]?\s?\d[ABD-HJLNP-UW-Z]{2}|[A-PR-UWYZ]\d{2}\s?\d[ABD-HJLNP-UW-Z]{2}|[A-PR-UWYZ][A-HK-Y]\d[ABEHMNPRVWXY]?\s?\d[ABD-HJLNP-UW-Z]{2}|[A-PR-UWYZ][A-HK-Y]\d{2}\s?\d[ABD-HJLNP-UW-Z]{2})\b/g
+  ],
+  contextWords: [
+    "postcode",
+    "post code",
+    "postal code",
+    "zip",
+    "address",
+    "delivery",
+    "mailing",
+    "shipping"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var UK_VEHICLE_REGISTRATION = {
+  entityType: "UK_VEHICLE_REGISTRATION",
+  patterns: [
+    // Current format
+    /\b[A-HJ-PR-Y]{2}(?:0[1-9]|[1-7]\d)[- ]?[A-HJ-PR-Z]{3}\b/g,
+    // Prefix format
+    /\b[A-HJ-NPR-TV-Y]\d{1,3}[- ]?[A-HJ-PR-Y][A-HJ-PR-Z]{2}\b/g,
+    // Suffix format
+    /\b[A-HJ-PR-Z]{3}[- ]?\d{1,3}[- ]?[A-HJ-NPR-TV-Y]\b/g
+  ],
+  contextWords: [
+    "vehicle",
+    "registration",
+    "number plate",
+    "licence plate",
+    "license plate",
+    "reg",
+    "vrn",
+    "dvla",
+    "v5c",
+    "mot",
+    "car"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.2
+};
+var UK_PATTERNS = [
+  UK_NHS,
+  UK_NINO,
+  UK_PASSPORT,
+  UK_POSTCODE,
+  UK_VEHICLE_REGISTRATION
+];
+
+// src/patterns/pii/eu.ts
+var ES_NIF = {
+  entityType: "ES_NIF",
+  patterns: [/\b\d{7,8}[-]?[A-Z]\b/g],
+  validate: (match) => {
+    const cleaned = match.replace(/-/g, "");
+    const letter = cleaned.slice(-1);
+    const number = parseInt(cleaned.replace(/[^0-9]/g, ""), 10);
+    const letters = "TRWAGMYFPDXBNJZSQVHLCKE";
+    return letter === letters[number % 23];
+  },
+  contextWords: ["documento nacional de identidad", "dni", "nif", "identificaci\xF3n"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var ES_NIE = {
+  entityType: "ES_NIE",
+  patterns: [/\b[XYZ]\d{7}[-]?[A-Z]\b/g],
+  validate: (match) => {
+    const cleaned = match.replace(/-/g, "");
+    if (cleaned.length < 8 || cleaned.length > 9) return false;
+    const letter = cleaned.slice(-1);
+    const prefix = "XYZ".indexOf(cleaned[0]);
+    if (prefix === -1) return false;
+    const number = parseInt(prefix.toString() + cleaned.slice(1, -1), 10);
+    const letters = "TRWAGMYFPDXBNJZSQVHLCKE";
+    return letter === letters[number % 23];
+  },
+  contextWords: ["n\xFAmero de identificaci\xF3n de extranjero", "nie"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var IT_FISCAL_CODE = {
+  entityType: "IT_FISCAL_CODE",
+  patterns: [
+    /(?:[A-Z][AEIOU][AEIOUX]|[AEIOU]X{2}|[B-DF-HJ-NP-TV-Z]{2}[A-Z]){2}(?:[\dLMNP-V]{2}(?:[A-EHLMPR-T](?:[04LQ][1-9MNP-V]|[15MR][\dLMNP-V]|[26NS][0-8LMNP-U])|[DHPS][37PT][0L]|[ACELMRT][37PT][01LM]|[AC-EHLMPR-T][26NS][9V])|(?:[02468LNQSU][048LQU]|[13579MPRTV][26NS])B[26NS][9V])(?:[A-MZ][1-9MNP-V][\dLMNP-V]{2}|[A-M][0L](?:[1-9MNP-V][\dLMNP-V]|[0L][1-9MNP-V]))[A-Z]/gi
+  ],
+  validate: (match) => {
+    const text = match.toUpperCase();
+    if (text.length !== 16) return false;
+    const control = text[15];
+    const toValidate = text.slice(0, 15);
+    const mapOdd = {
+      "0": 1,
+      "1": 0,
+      "2": 5,
+      "3": 7,
+      "4": 9,
+      "5": 13,
+      "6": 15,
+      "7": 17,
+      "8": 19,
+      "9": 21,
+      A: 1,
+      B: 0,
+      C: 5,
+      D: 7,
+      E: 9,
+      F: 13,
+      G: 15,
+      H: 17,
+      I: 19,
+      J: 21,
+      K: 2,
+      L: 4,
+      M: 18,
+      N: 20,
+      O: 11,
+      P: 3,
+      Q: 6,
+      R: 8,
+      S: 12,
+      T: 14,
+      U: 16,
+      V: 10,
+      W: 22,
+      X: 25,
+      Y: 24,
+      Z: 23
+    };
+    const mapEven = {
+      "0": 0,
+      "1": 1,
+      "2": 2,
+      "3": 3,
+      "4": 4,
+      "5": 5,
+      "6": 6,
+      "7": 7,
+      "8": 8,
+      "9": 9,
+      A: 0,
+      B: 1,
+      C: 2,
+      D: 3,
+      E: 4,
+      F: 5,
+      G: 6,
+      H: 7,
+      I: 8,
+      J: 9,
+      K: 10,
+      L: 11,
+      M: 12,
+      N: 13,
+      O: 14,
+      P: 15,
+      Q: 16,
+      R: 17,
+      S: 18,
+      T: 19,
+      U: 20,
+      V: 21,
+      W: 22,
+      X: 23,
+      Y: 24,
+      Z: 25
+    };
+    let oddSum = 0;
+    let evenSum = 0;
+    for (let i = 0; i < toValidate.length; i++) {
+      if (i % 2 === 0) {
+        oddSum += mapOdd[toValidate[i]] ?? 0;
+      } else {
+        evenSum += mapEven[toValidate[i]] ?? 0;
+      }
+    }
+    const expected = String.fromCharCode(65 + (oddSum + evenSum) % 26);
+    return expected === control;
+  },
+  contextWords: ["codice fiscale", "cf"],
+  baseConfidence: "medium",
+  baseScore: 0.3
+};
+var IT_DRIVER_LICENSE = {
+  entityType: "IT_DRIVER_LICENSE",
+  patterns: [
+    /\b(?:[A-Z]{2}\d{7}[A-Z]|U1[BCDEFGHLJKMNPRSTUWYXZ0-9]{7}[A-Z])\b/gi
+  ],
+  contextWords: ["patente", "patente di guida", "licenza", "licenza di guida"],
+  baseConfidence: "low",
+  baseScore: 0.2
+};
+var IT_VAT_CODE = {
+  entityType: "IT_VAT_CODE",
+  patterns: [/\b\d{11}\b/g],
+  validate: (match) => {
+    const digits = match.replace(/[\s_]/g, "");
+    if (digits.length !== 11) return false;
+    if (digits === "00000000000") return false;
+    let x = 0;
+    let y = 0;
+    for (let i = 0; i < 5; i++) {
+      x += parseInt(digits[2 * i], 10);
+      let tmpY = parseInt(digits[2 * i + 1], 10) * 2;
+      if (tmpY > 9) tmpY -= 9;
+      y += tmpY;
+    }
+    const t = (x + y) % 10;
+    const c = (10 - t) % 10;
+    return c === parseInt(digits[10], 10);
+  },
+  contextWords: ["piva", "partita iva", "pi"],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var IT_PASSPORT = {
+  entityType: "IT_PASSPORT",
+  patterns: [/\b[A-Z]{2}\d{7}\b/gi],
+  contextWords: ["passaporto", "elettronico", "italiano", "viaggio", "documento"],
+  baseConfidence: "low",
+  baseScore: 0.01
+};
+var IT_IDENTITY_CARD = {
+  entityType: "IT_IDENTITY_CARD",
+  patterns: [
+    /\b[A-Z]{2}\s?\d{7}\b/gi,
+    /\b\d{7}[A-Z]{2}\b/gi,
+    /\b[A-Z]{2}\d{5}[A-Z]{2}\b/gi
+  ],
+  contextWords: ["carta", "identit\xE0", "elettronica", "cie", "documento"],
+  baseConfidence: "low",
+  baseScore: 0.01
+};
+var PL_PESEL = {
+  entityType: "PL_PESEL",
+  patterns: [
+    /\b\d{2}(?:[02468][1-9]|[13579][012])(?:0[1-9]|[12]\d|3[01])\d{5}\b/g
+  ],
+  validate: (match) => {
+    if (match.length !== 11) return false;
+    const digits = match.split("").map(Number);
+    const weights = [1, 3, 7, 9, 1, 3, 7, 9, 1, 3];
+    let checksum = 0;
+    for (let i = 0; i < 10; i++) {
+      checksum += digits[i] * weights[i];
+    }
+    return checksum % 10 === digits[10];
+  },
+  contextWords: ["pesel"],
+  baseConfidence: "medium",
+  baseScore: 0.4
+};
+var FI_PERSONAL_IDENTITY_CODE = {
+  entityType: "FI_PERSONAL_IDENTITY_CODE",
+  patterns: [
+    /\b(\d{6})([+\-ABCDEFYXWVU])(\d{3})([0-9ABCDEFHJKLMNPRSTUVWXY])\b/g
+  ],
+  validate: (match) => {
+    if (match.length !== 11) return false;
+    const datePart = match.slice(0, 6);
+    const individual = match.slice(7, 10);
+    const control = match[10];
+    const validChars = "0123456789ABCDEFHJKLMNPRSTUVWXY";
+    const num = parseInt(datePart + individual, 10);
+    return validChars[num % 31] === control;
+  },
+  contextWords: ["hetu", "henkil\xF6tunnus", "personal identity code"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var SE_PERSONNUMMER = {
+  entityType: "SE_PERSONNUMMER",
+  patterns: [/\b(\d{6,8})([-+]?)\d{4}\b/g],
+  validate: (match) => {
+    const digits = match.replace(/[-+]/g, "");
+    const last10 = digits.slice(-10);
+    if (last10.length !== 10) return false;
+    const month = parseInt(last10.slice(2, 4), 10);
+    let day = parseInt(last10.slice(4, 6), 10);
+    if (day >= 61) day -= 60;
+    if (month < 1 || month > 12 || day < 1 || day > 31) return false;
+    const nums = last10.split("").map(Number);
+    const check = nums[9];
+    let sum = 0;
+    for (let i = 0; i < 9; i++) {
+      let d = nums[i];
+      if (i % 2 === 0) {
+        d *= 2;
+        if (d > 9) d -= 9;
+      }
+      sum += d;
+    }
+    return (sum + check) % 10 === 0;
+  },
+  contextWords: [
+    "personnummer",
+    "svenskt personnummer",
+    "svensk id",
+    "personal identity number",
+    "samordningsnummer"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var DE_TAX_ID = {
+  entityType: "DE_TAX_ID",
+  patterns: [/\b[1-9]\d{10}\b/g],
+  validate: (match) => {
+    if (match.length !== 11 || !/^\d+$/.test(match)) return false;
+    const digits = match.split("").map(Number);
+    if (new Set(digits.slice(0, 10)).size === 1) return false;
+    let product = 10;
+    for (let i = 0; i < 10; i++) {
+      let total = (digits[i] + product) % 10;
+      if (total === 0) total = 10;
+      product = total * 2 % 11;
+    }
+    let check = 11 - product;
+    if (check === 10) check = 0;
+    return check === digits[10];
+  },
+  contextWords: [
+    "steueridentifikationsnummer",
+    "steuer-id",
+    "steuerid",
+    "idnr",
+    "steuer-idnr",
+    "steuernummer"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var DE_PASSPORT = {
+  entityType: "DE_PASSPORT",
+  patterns: [
+    /\b[CFGHJKLMNPRTVWXYZ][CFGHJKLMNPRTVWXYZ0-9]{7}[CFGHJKLMNPRTVWXYZ0-9]\b/g,
+    /\bT\d{8}\b/g
+  ],
+  contextWords: [
+    "personalausweis",
+    "ausweis",
+    "reisepass",
+    "pass",
+    "dokumentennummer",
+    "seriennummer"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.4
+};
+var EU_PATTERNS = [
+  ES_NIF,
+  ES_NIE,
+  IT_FISCAL_CODE,
+  IT_DRIVER_LICENSE,
+  IT_VAT_CODE,
+  IT_PASSPORT,
+  IT_IDENTITY_CARD,
+  PL_PESEL,
+  FI_PERSONAL_IDENTITY_CODE,
+  SE_PERSONNUMMER,
+  DE_TAX_ID,
+  DE_PASSPORT
+];
+
+// src/validators/verhoeff.ts
+var D = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
+  [1, 2, 3, 4, 0, 6, 7, 8, 9, 5],
+  [2, 3, 4, 0, 1, 7, 8, 9, 5, 6],
+  [3, 4, 0, 1, 2, 8, 9, 5, 6, 7],
+  [4, 0, 1, 2, 3, 9, 5, 6, 7, 8],
+  [5, 9, 8, 7, 6, 0, 4, 3, 2, 1],
+  [6, 5, 9, 8, 7, 1, 0, 4, 3, 2],
+  [7, 6, 5, 9, 8, 2, 1, 0, 4, 3],
+  [8, 7, 6, 5, 9, 3, 2, 1, 0, 4],
+  [9, 8, 7, 6, 5, 4, 3, 2, 1, 0]
+];
+var P = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
+  [1, 5, 7, 6, 2, 8, 3, 0, 9, 4],
+  [5, 8, 0, 3, 7, 9, 6, 1, 4, 2],
+  [8, 9, 1, 6, 0, 4, 3, 5, 2, 7],
+  [9, 4, 5, 3, 1, 2, 6, 8, 7, 0],
+  [4, 2, 8, 6, 5, 7, 3, 9, 0, 1],
+  [2, 7, 9, 3, 8, 0, 6, 4, 1, 5],
+  [7, 0, 4, 6, 9, 1, 3, 2, 5, 8]
+];
+var INV = [0, 4, 3, 2, 1, 5, 6, 7, 8, 9];
+function verhoeff(input) {
+  const digits = String(input).split("").map(Number).reverse();
+  let c = 0;
+  for (let i = 0; i < digits.length; i++) {
+    c = D[c][P[i % 8][digits[i]]];
+  }
+  return INV[c] === 0;
+}
+
+// src/patterns/pii/apac.ts
+var SG_NRIC_FIN = {
+  entityType: "SG_NRIC_FIN",
+  patterns: [/\b[STFGM]\d{7}[A-Z]\b/gi],
+  contextWords: ["fin", "nric"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var SG_UEN = {
+  entityType: "SG_UEN",
+  patterns: [
+    /\b\d{8}[A-Z]\b/g,
+    /\b\d{9}[A-Z]\b/g,
+    /\b[TS]\d{2}[A-Z]{2}\d{4}[A-Z]\b/g
+  ],
+  contextWords: ["uen", "unique entity number", "business registration", "acra"],
+  baseConfidence: "low",
+  baseScore: 0.3
+};
+var AU_ABN = {
+  entityType: "AU_ABN",
+  patterns: [
+    /\b\d{2}\s\d{3}\s\d{3}\s\d{3}\b/g,
+    /\b\d{11}\b/g
+  ],
+  validate: (match) => {
+    const digits = match.replace(/\s/g, "").split("").map(Number);
+    if (digits.length !== 11) return false;
+    const weights = [10, 1, 3, 5, 7, 9, 11, 13, 15, 17, 19];
+    digits[0] = digits[0] === 0 ? 9 : digits[0] - 1;
+    let sum = 0;
+    for (let i = 0; i < 11; i++) {
+      sum += digits[i] * weights[i];
+    }
+    return sum % 89 === 0;
+  },
+  contextWords: ["australian business number", "abn"],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var AU_ACN = {
+  entityType: "AU_ACN",
+  patterns: [
+    /\b\d{3}\s\d{3}\s\d{3}\b/g,
+    /\b\d{9}\b/g
+  ],
+  validate: (match) => {
+    const digits = match.replace(/\s/g, "").split("").map(Number);
+    if (digits.length !== 9) return false;
+    const weights = [8, 7, 6, 5, 4, 3, 2, 1];
+    let sum = 0;
+    for (let i = 0; i < 8; i++) {
+      sum += digits[i] * weights[i];
+    }
+    const complement = (10 - sum % 10) % 10;
+    return complement === digits[8];
+  },
+  contextWords: ["australian company number", "acn"],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var AU_TFN = {
+  entityType: "AU_TFN",
+  patterns: [
+    /\b\d{3}\s\d{3}\s\d{3}\b/g,
+    /\b\d{9}\b/g
+  ],
+  validate: (match) => {
+    const digits = match.replace(/\s/g, "").split("").map(Number);
+    if (digits.length !== 9) return false;
+    const weights = [1, 4, 3, 7, 5, 8, 6, 9, 10];
+    let sum = 0;
+    for (let i = 0; i < 9; i++) {
+      sum += digits[i] * weights[i];
+    }
+    return sum % 11 === 0;
+  },
+  contextWords: ["tax file number", "tfn"],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var AU_MEDICARE = {
+  entityType: "AU_MEDICARE",
+  patterns: [
+    /\b[2-6]\d{3}\s\d{5}\s\d\b/g,
+    /\b[2-6]\d{9}\b/g
+  ],
+  validate: (match) => {
+    const digits = match.replace(/\s/g, "").split("").map(Number);
+    if (digits.length !== 10) return false;
+    const weights = [1, 3, 7, 9, 1, 3, 7, 9];
+    let sum = 0;
+    for (let i = 0; i < 8; i++) {
+      sum += digits[i] * weights[i];
+    }
+    return sum % 10 === digits[8];
+  },
+  contextWords: ["medicare"],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var IN_PAN = {
+  entityType: "IN_PAN",
+  patterns: [
+    /\b[A-Z]{3}[ABCFGHHJLPT][A-Z]\d{4}[A-Z]\b/gi,
+    /\b[A-Z]{5}\d{4}[A-Z]\b/gi
+  ],
+  contextWords: ["permanent account number", "pan"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var IN_AADHAAR = {
+  entityType: "IN_AADHAAR",
+  patterns: [
+    /\b\d{4}[- :]\d{4}[- :]\d{4}\b/g,
+    /\b\d{12}\b/g
+  ],
+  validate: (match) => {
+    const digits = match.replace(/\D/g, "");
+    if (digits.length !== 12) return false;
+    if (parseInt(digits[0], 10) < 2) return false;
+    if (digits === digits.split("").reverse().join("")) return false;
+    return verhoeff(parseInt(digits, 10));
+  },
+  contextWords: ["aadhaar", "uidai"],
+  baseConfidence: "low",
+  baseScore: 0.01
+};
+var IN_VEHICLE_REGISTRATION = {
+  entityType: "IN_VEHICLE_REGISTRATION",
+  patterns: [
+    /\b[A-Z]{2}\d{2}[A-Z]{1,2}\d{4}\b/g,
+    /\b[A-Z]{2}\d[A-Z]{1,3}\d{4}\b/g
+  ],
+  contextWords: ["rto", "vehicle", "plate", "registration"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var IN_VOTER = {
+  entityType: "IN_VOTER",
+  patterns: [
+    /\b[A-Z]{3}\d{7}\b/gi
+  ],
+  contextWords: ["voter", "epic", "elector photo identity card"],
+  baseConfidence: "low",
+  baseScore: 0.3
+};
+var IN_PASSPORT = {
+  entityType: "IN_PASSPORT",
+  patterns: [/\b[A-Z][1-9]\d\s?\d{4}[1-9]\b/g],
+  contextWords: ["passport", "indian passport", "passport number"],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var KR_RRN = {
+  entityType: "KR_RRN",
+  patterns: [
+    /(?<!\d)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])-?[1-4]\d{6}(?!\d)/g
+  ],
+  validate: (match) => {
+    const digits = match.replace(/-/g, "");
+    if (digits.length !== 13 || !/^\d+$/.test(digits)) return false;
+    const regionCode = parseInt(digits.slice(7, 9), 10);
+    if (regionCode > 95) return false;
+    const weights = [2, 3, 4, 5, 6, 7, 8, 9, 2, 3, 4, 5];
+    let sum = 0;
+    for (let i = 0; i < 12; i++) {
+      sum += parseInt(digits[i], 10) * weights[i];
+    }
+    const checksum = (11 - sum % 11) % 10;
+    return checksum === parseInt(digits[12], 10);
+  },
+  contextWords: [
+    "resident registration number",
+    "rrn",
+    "korean rrn"
+  ],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var KR_PASSPORT = {
+  entityType: "KR_PASSPORT",
+  patterns: [
+    /(?<![A-Z0-9])[MSROD]\d{3}[A-Z]\d{4}(?!\d)/gi,
+    /(?<![A-Z0-9])[MSROD]\d{8}(?!\d)/gi
+  ],
+  contextWords: ["passport", "korean passport", "\uC5EC\uAD8C"],
+  baseConfidence: "low",
+  baseScore: 0.1
+};
+var TH_TNIN = {
+  entityType: "TH_TNIN",
+  patterns: [
+    /\b[1-9](?:[134]\d|[25][0134567]|[67][01234567]|[89][0123456])\d{10}\b/g
+  ],
+  validate: (match) => {
+    if (match.length !== 13 || !/^\d+$/.test(match)) return false;
+    const weights = [13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2];
+    let sum = 0;
+    for (let i = 0; i < 12; i++) {
+      sum += weights[i] * parseInt(match[i], 10);
+    }
+    const x = sum % 11;
+    const expected = x <= 1 ? 1 - x : 11 - x;
+    return expected === parseInt(match[12], 10);
+  },
+  contextWords: ["thai national id", "thai id number", "tnin"],
+  baseConfidence: "medium",
+  baseScore: 0.5
+};
+var NG_NIN = {
+  entityType: "NG_NIN",
+  patterns: [/\b\d{11}\b/g],
+  validate: (match) => {
+    if (match.length !== 11 || !/^\d+$/.test(match)) return false;
+    return verhoeff(parseInt(match, 10));
+  },
+  contextWords: [
+    "nin",
+    "national identification number",
+    "national identity number",
+    "nimc"
+  ],
+  baseConfidence: "low",
+  baseScore: 0.01
+};
+var APAC_PATTERNS = [
+  SG_NRIC_FIN,
+  SG_UEN,
+  AU_ABN,
+  AU_ACN,
+  AU_TFN,
+  AU_MEDICARE,
+  IN_PAN,
+  IN_AADHAAR,
+  IN_VEHICLE_REGISTRATION,
+  IN_VOTER,
+  IN_PASSPORT,
+  KR_RRN,
+  KR_PASSPORT,
+  TH_TNIN,
+  NG_NIN
+];
+
+// src/patterns/pii/index.ts
+var ALL_PII_PATTERNS = [
+  ...GENERIC_PATTERNS,
+  ...US_PATTERNS,
+  ...UK_PATTERNS,
+  ...EU_PATTERNS,
+  ...APAC_PATTERNS
+];
+
+// src/guards/pii.guard.ts
+var CONTEXT_WINDOW = 100;
+var CONTEXT_SCORE_BOOST = 0.35;
+var PiiGuard = class extends BaseGuard {
+  name = "pii";
+  patterns;
+  constructor(options) {
+    super();
+    let patterns = ALL_PII_PATTERNS;
+    if (options?.entityTypes && options.entityTypes.length > 0) {
+      const allowed = new Set(options.entityTypes);
+      patterns = patterns.filter((p) => allowed.has(p.entityType));
+    }
+    if (options?.customPatterns) {
+      patterns = [...patterns, ...options.customPatterns];
+    }
+    this.patterns = patterns;
+  }
+  async analyze(text, config) {
+    const cfg = this.mergeConfig(config);
+    const detections = this.detectAll(text, cfg.threshold);
+    return this.buildResult(text, detections, cfg.mode);
+  }
+  detectAll(text, threshold) {
+    const allDetections = [];
+    const textLower = text.toLowerCase();
+    for (const pattern of this.patterns) {
+      for (const regex of pattern.patterns) {
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(text)) !== null) {
+          const matchText = match[0];
+          const start = match.index;
+          const end = start + matchText.length;
+          if (pattern.validate && !pattern.validate(matchText)) {
+            continue;
+          }
+          let score = pattern.baseScore;
+          let confidence = pattern.baseConfidence;
+          if (pattern.contextWords && pattern.contextWords.length > 0) {
+            const contextStart = Math.max(0, start - CONTEXT_WINDOW);
+            const contextEnd = Math.min(text.length, end + CONTEXT_WINDOW);
+            const context = textLower.slice(contextStart, contextEnd);
+            const hasContext = pattern.contextWords.some(
+              (word) => context.includes(word.toLowerCase())
+            );
+            if (hasContext) {
+              score = Math.min(1, score + CONTEXT_SCORE_BOOST);
+              if (confidence === "low") confidence = "medium";
+              else if (confidence === "medium") confidence = "high";
+            }
+          }
+          if (score < threshold) continue;
+          allDetections.push(
+            this.makeDetection(text, {
+              entityType: pattern.entityType,
+              start,
+              end,
+              text: matchText,
+              confidence,
+              score,
+              guardName: this.name
+            })
+          );
+        }
+      }
+    }
+    return this.deduplicateDetections(allDetections);
+  }
+  deduplicateDetections(detections) {
+    if (detections.length <= 1) return detections;
+    const sorted = [...detections].sort((a, b) => b.score - a.score);
+    const result = [];
+    for (const detection of sorted) {
+      const overlaps = result.some(
+        (existing) => detection.start < existing.end && detection.end > existing.start
+      );
+      if (!overlaps) {
+        result.push(detection);
+      }
+    }
+    return result.sort((a, b) => a.start - b.start);
+  }
+};
+
+// src/patterns/secrets/cloud.ts
+var AWS_ACCESS_KEY = {
+  secretType: "AWS_ACCESS_KEY",
+  patterns: [/(?<![A-Z0-9])AKIA[0-9A-Z]{16}(?![A-Z0-9])/g]
+};
+var AWS_SECRET_KEY = {
+  secretType: "AWS_SECRET_KEY",
+  patterns: [
+    /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/g
+  ],
+  minEntropy: 4.5
+};
+var AWS_SESSION_TOKEN = {
+  secretType: "AWS_SESSION_TOKEN",
+  patterns: [/(?:aws_session_token|AWS_SESSION_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9/+=]{100,})["']?/g],
+  minEntropy: 4
+};
+var AWS_MWS_KEY = {
+  secretType: "AWS_MWS_KEY",
+  patterns: [/amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g]
+};
+var AZURE_CONNECTION_STRING = {
+  secretType: "AZURE_CONNECTION_STRING",
+  patterns: [
+    /DefaultEndpointsProtocol=https?;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/=]+;?/g,
+    /(?:AccountKey|SharedAccessKey|SharedAccessSignature)=[A-Za-z0-9+/=]{20,}/g
+  ]
+};
+var AZURE_AD_CLIENT_SECRET = {
+  secretType: "AZURE_AD_CLIENT_SECRET",
+  patterns: [/(?:client_secret|AZURE_CLIENT_SECRET)\s*[:=]\s*["']?([A-Za-z0-9~._-]{34,})["']?/g],
+  minEntropy: 3.5
+};
+var AZURE_STORAGE_KEY = {
+  secretType: "AZURE_STORAGE_KEY",
+  patterns: [/[A-Za-z0-9+/]{86}==/g],
+  minEntropy: 5
+};
+var AZURE_FUNCTION_KEY = {
+  secretType: "AZURE_FUNCTION_KEY",
+  patterns: [/(?:x-functions-key|functionkey)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/gi],
+  minEntropy: 3.5
+};
+var GCP_SERVICE_ACCOUNT = {
+  secretType: "GCP_SERVICE_ACCOUNT",
+  patterns: [/"private_key"\s*:\s*"-----BEGIN (?:RSA )?PRIVATE KEY-----/g]
+};
+var GCP_API_KEY = {
+  secretType: "GCP_API_KEY",
+  patterns: [/AIza[0-9A-Za-z_-]{35}/g]
+};
+var GCP_OAUTH_SECRET = {
+  secretType: "GCP_OAUTH_SECRET",
+  patterns: [/GOCSPX-[A-Za-z0-9_-]{28}/g]
+};
+var IBM_CLOUD_API_KEY = {
+  secretType: "IBM_CLOUD_API_KEY",
+  patterns: [/(?:ibm[-_]?(?:cloud)?[-_]?api[-_]?key)\s*[:=]\s*["']?([A-Za-z0-9_-]{44})["']?/gi]
+};
+var IBM_COS_HMAC = {
+  secretType: "IBM_COS_HMAC",
+  patterns: [/(?:cos_hmac_keys|ibm_cos)\s*[:=]\s*["']?([A-Za-z0-9]{32,})["']?/gi],
+  minEntropy: 3.5
+};
+var DIGITALOCEAN_TOKEN = {
+  secretType: "DIGITALOCEAN_TOKEN",
+  patterns: [
+    /dop_v1_[a-f0-9]{64}/g,
+    /doo_v1_[a-f0-9]{64}/g,
+    /dor_v1_[a-f0-9]{64}/g
+  ]
+};
+var DIGITALOCEAN_SPACES_KEY = {
+  secretType: "DIGITALOCEAN_SPACES_KEY",
+  patterns: [/(?:SPACES_ACCESS_KEY_ID|DO_SPACES_KEY)\s*[:=]\s*["']?([A-Z0-9]{20})["']?/g]
+};
+var LINODE_TOKEN = {
+  secretType: "LINODE_TOKEN",
+  patterns: [/(?:LINODE_TOKEN|LINODE_API_TOKEN)\s*[:=]\s*["']?([a-f0-9]{64})["']?/g]
+};
+var VULTR_API_KEY = {
+  secretType: "VULTR_API_KEY",
+  patterns: [/(?:VULTR_API_KEY)\s*[:=]\s*["']?([A-Z0-9]{36})["']?/g]
+};
+var ORACLE_CLOUD_KEY = {
+  secretType: "ORACLE_CLOUD_KEY",
+  patterns: [/(?:OCI_API_KEY|ORACLE_CLOUD_KEY)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40,})["']?/g],
+  minEntropy: 4
+};
+var ALIBABA_CLOUD_KEY = {
+  secretType: "ALIBABA_CLOUD_KEY",
+  patterns: [/LTAI[A-Za-z0-9]{12,20}/g]
+};
+var CLOUD_PATTERNS = [
+  AWS_ACCESS_KEY,
+  AWS_SECRET_KEY,
+  AWS_SESSION_TOKEN,
+  AWS_MWS_KEY,
+  AZURE_CONNECTION_STRING,
+  AZURE_AD_CLIENT_SECRET,
+  AZURE_STORAGE_KEY,
+  AZURE_FUNCTION_KEY,
+  GCP_SERVICE_ACCOUNT,
+  GCP_API_KEY,
+  GCP_OAUTH_SECRET,
+  IBM_CLOUD_API_KEY,
+  IBM_COS_HMAC,
+  DIGITALOCEAN_TOKEN,
+  DIGITALOCEAN_SPACES_KEY,
+  LINODE_TOKEN,
+  VULTR_API_KEY,
+  ORACLE_CLOUD_KEY,
+  ALIBABA_CLOUD_KEY
+];
+
+// src/patterns/secrets/source-control.ts
+var GITHUB_TOKEN = {
+  secretType: "GITHUB_TOKEN",
+  patterns: [
+    /ghp_[A-Za-z0-9]{36}/g,
+    /gho_[A-Za-z0-9]{36}/g,
+    /ghu_[A-Za-z0-9]{36}/g,
+    /ghs_[A-Za-z0-9]{36}/g,
+    /ghr_[A-Za-z0-9]{36}/g,
+    /github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}/g
+  ]
+};
+var GITHUB_APP_TOKEN = {
+  secretType: "GITHUB_APP_TOKEN",
+  patterns: [/(?:ghu|ghs)_[A-Za-z0-9]{36}/g]
+};
+var GITHUB_FINE_GRAINED_TOKEN = {
+  secretType: "GITHUB_FINE_GRAINED_TOKEN",
+  patterns: [/github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}/g]
+};
+var GITLAB_TOKEN = {
+  secretType: "GITLAB_TOKEN",
+  patterns: [
+    /glpat-[A-Za-z0-9\-_]{20}/g,
+    /glcbt-[A-Za-z0-9]{1,5}_[A-Za-z0-9_\-]{20}/g,
+    /gldt-[A-Za-z0-9_\-]{20}/g,
+    /glft-[A-Za-z0-9_\-]{20}/g,
+    /glsoat-[A-Za-z0-9_\-]{20}/g,
+    /GR1348941[A-Za-z0-9_\-]{20}/g
+  ]
+};
+var GITLAB_PIPELINE_TOKEN = {
+  secretType: "GITLAB_PIPELINE_TOKEN",
+  patterns: [/glptt-[A-Za-z0-9]{20}/g]
+};
+var BITBUCKET_APP_PASSWORD = {
+  secretType: "BITBUCKET_APP_PASSWORD",
+  patterns: [/(?:BITBUCKET_APP_PASSWORD|BB_APP_PASSWORD)\s*[:=]\s*["']?([A-Za-z0-9]{18,})["']?/g],
+  minEntropy: 3.5
+};
+var BITBUCKET_CLIENT_SECRET = {
+  secretType: "BITBUCKET_CLIENT_SECRET",
+  patterns: [/(?:BITBUCKET_CLIENT_SECRET|BB_CLIENT_SECRET)\s*[:=]\s*["']?([A-Za-z0-9_-]{32,})["']?/g],
+  minEntropy: 3.5
+};
+var AZURE_DEVOPS_TOKEN = {
+  secretType: "AZURE_DEVOPS_TOKEN",
+  patterns: [/(?:AZURE_DEVOPS_PAT|ADO_TOKEN|SYSTEM_ACCESSTOKEN)\s*[:=]\s*["']?([A-Za-z0-9]{52,})["']?/g],
+  minEntropy: 4
+};
+var GITEA_TOKEN = {
+  secretType: "GITEA_TOKEN",
+  patterns: [/(?:GITEA_TOKEN)\s*[:=]\s*["']?([a-f0-9]{40})["']?/g]
+};
+var SOURCE_CONTROL_PATTERNS = [
+  GITHUB_TOKEN,
+  GITHUB_APP_TOKEN,
+  GITHUB_FINE_GRAINED_TOKEN,
+  GITLAB_TOKEN,
+  GITLAB_PIPELINE_TOKEN,
+  BITBUCKET_APP_PASSWORD,
+  BITBUCKET_CLIENT_SECRET,
+  AZURE_DEVOPS_TOKEN,
+  GITEA_TOKEN
+];
+
+// src/patterns/secrets/cicd.ts
+var JENKINS_API_TOKEN = {
+  secretType: "JENKINS_API_TOKEN",
+  patterns: [/(?:JENKINS_TOKEN|JENKINS_API_TOKEN)\s*[:=]\s*["']?([a-f0-9]{32,})["']?/gi]
+};
+var JENKINS_CRUMB = {
+  secretType: "JENKINS_CRUMB",
+  patterns: [/Jenkins-Crumb:\s*([a-f0-9]{32,})/g]
+};
+var CIRCLECI_TOKEN = {
+  secretType: "CIRCLECI_TOKEN",
+  patterns: [
+    /(?:CIRCLECI_TOKEN|CIRCLE_TOKEN)\s*[:=]\s*["']?([a-f0-9]{40})["']?/g,
+    /circle-token\s*[:=]\s*["']?([a-f0-9]{40})["']?/g
+  ]
+};
+var TRAVIS_CI_TOKEN = {
+  secretType: "TRAVIS_CI_TOKEN",
+  patterns: [/(?:TRAVIS_TOKEN|TRAVIS_API_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{20,})["']?/g],
+  minEntropy: 3.5
+};
+var GITHUB_ACTIONS_SECRET = {
+  secretType: "GITHUB_ACTIONS_SECRET",
+  patterns: [/(?:ACTIONS_SECRET|GH_ACTION_SECRET)\s*[:=]\s*["']?([A-Za-z0-9_-]{20,})["']?/g],
+  minEntropy: 3.5
+};
+var BUILDKITE_TOKEN = {
+  secretType: "BUILDKITE_TOKEN",
+  patterns: [/bkua_[A-Za-z0-9]{40}/g]
+};
+var BUILDKITE_AGENT_TOKEN = {
+  secretType: "BUILDKITE_AGENT_TOKEN",
+  patterns: [/(?:BUILDKITE_AGENT_TOKEN)\s*[:=]\s*["']?([a-f0-9]{40,})["']?/g]
+};
+var DRONE_CI_TOKEN = {
+  secretType: "DRONE_CI_TOKEN",
+  patterns: [/(?:DRONE_TOKEN|DRONE_SERVER_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9]{32,})["']?/g],
+  minEntropy: 3.5
+};
+var CODECOV_TOKEN = {
+  secretType: "CODECOV_TOKEN",
+  patterns: [/(?:CODECOV_TOKEN)\s*[:=]\s*["']?([a-f0-9-]{36})["']?/g]
+};
+var SONARQUBE_TOKEN = {
+  secretType: "SONARQUBE_TOKEN",
+  patterns: [
+    /squ_[A-Za-z0-9]{40}/g,
+    /sqp_[A-Za-z0-9]{40}/g
+  ]
+};
+var TEAMCITY_TOKEN = {
+  secretType: "TEAMCITY_TOKEN",
+  patterns: [/(?:TEAMCITY_TOKEN|TC_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{20,})["']?/g],
+  minEntropy: 3.5
+};
+var CICD_PATTERNS = [
+  JENKINS_API_TOKEN,
+  JENKINS_CRUMB,
+  CIRCLECI_TOKEN,
+  TRAVIS_CI_TOKEN,
+  GITHUB_ACTIONS_SECRET,
+  BUILDKITE_TOKEN,
+  BUILDKITE_AGENT_TOKEN,
+  DRONE_CI_TOKEN,
+  CODECOV_TOKEN,
+  SONARQUBE_TOKEN,
+  TEAMCITY_TOKEN
+];
+
+// src/patterns/secrets/communication.ts
+var SLACK_TOKEN = {
+  secretType: "SLACK_TOKEN",
+  patterns: [/xox[bporas]-[A-Za-z0-9-]{10,}/g]
+};
+var SLACK_WEBHOOK = {
+  secretType: "SLACK_WEBHOOK",
+  patterns: [/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]{8,}\/B[A-Z0-9]{8,}\/[A-Za-z0-9]{24}/g]
+};
+var SLACK_APP_TOKEN = {
+  secretType: "SLACK_APP_TOKEN",
+  patterns: [/xapp-[0-9]+-[A-Za-z0-9]+-[0-9]+-[A-Za-z0-9]+/g]
+};
+var DISCORD_TOKEN = {
+  secretType: "DISCORD_TOKEN",
+  patterns: [/(?:DISCORD_TOKEN|DISCORD_BOT_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,})["']?/g]
+};
+var DISCORD_WEBHOOK = {
+  secretType: "DISCORD_WEBHOOK",
+  patterns: [/https:\/\/(?:ptb\.|canary\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/g]
+};
+var TELEGRAM_BOT_TOKEN = {
+  secretType: "TELEGRAM_BOT_TOKEN",
+  patterns: [/[0-9]{8,10}:[A-Za-z0-9_-]{35}/g]
+};
+var TWILIO_KEY = {
+  secretType: "TWILIO_KEY",
+  patterns: [/SK[0-9a-fA-F]{32}/g]
+};
+var TWILIO_ACCOUNT_SID = {
+  secretType: "TWILIO_ACCOUNT_SID",
+  patterns: [/AC[a-f0-9]{32}/g]
+};
+var TWILIO_AUTH_TOKEN = {
+  secretType: "TWILIO_AUTH_TOKEN",
+  patterns: [/(?:TWILIO_AUTH_TOKEN)\s*[:=]\s*["']?([a-f0-9]{32})["']?/g]
+};
+var SENDGRID_KEY = {
+  secretType: "SENDGRID_KEY",
+  patterns: [/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g]
+};
+var MAILGUN_KEY = {
+  secretType: "MAILGUN_KEY",
+  patterns: [
+    /key-[A-Za-z0-9]{32}/g,
+    /(?:MAILGUN_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9-]{32,})["']?/g
+  ]
+};
+var MAILCHIMP_KEY = {
+  secretType: "MAILCHIMP_KEY",
+  patterns: [/[a-f0-9]{32}-us[0-9]{1,2}/g]
+};
+var POSTMARK_TOKEN = {
+  secretType: "POSTMARK_TOKEN",
+  patterns: [/(?:POSTMARK_API_TOKEN|POSTMARK_SERVER_TOKEN)\s*[:=]\s*["']?([a-f0-9-]{36})["']?/g]
+};
+var TEAMS_WEBHOOK = {
+  secretType: "TEAMS_WEBHOOK",
+  patterns: [/https:\/\/[a-z0-9-]+\.webhook\.office\.com\/webhookb2\/[A-Za-z0-9-]+/g]
+};
+var INTERCOM_TOKEN = {
+  secretType: "INTERCOM_TOKEN",
+  patterns: [/(?:INTERCOM_TOKEN|INTERCOM_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_=-]{20,})["']?/g],
+  minEntropy: 3.5
+};
+var COMMUNICATION_PATTERNS = [
+  SLACK_TOKEN,
+  SLACK_WEBHOOK,
+  SLACK_APP_TOKEN,
+  DISCORD_TOKEN,
+  DISCORD_WEBHOOK,
+  TELEGRAM_BOT_TOKEN,
+  TWILIO_KEY,
+  TWILIO_ACCOUNT_SID,
+  TWILIO_AUTH_TOKEN,
+  SENDGRID_KEY,
+  MAILGUN_KEY,
+  MAILCHIMP_KEY,
+  POSTMARK_TOKEN,
+  TEAMS_WEBHOOK,
+  INTERCOM_TOKEN
+];
+
+// src/patterns/secrets/payment.ts
+var STRIPE_KEY = {
+  secretType: "STRIPE_KEY",
+  patterns: [
+    /sk_live_[A-Za-z0-9]{20,}/g,
+    /rk_live_[A-Za-z0-9]{20,}/g,
+    /sk_test_[A-Za-z0-9]{20,}/g,
+    /rk_test_[A-Za-z0-9]{20,}/g
+  ]
+};
+var STRIPE_WEBHOOK_SECRET = {
+  secretType: "STRIPE_WEBHOOK_SECRET",
+  patterns: [/whsec_[A-Za-z0-9]{32,}/g]
+};
+var SQUARE_ACCESS_TOKEN = {
+  secretType: "SQUARE_ACCESS_TOKEN",
+  patterns: [
+    /sq0atp-[A-Za-z0-9_-]{22}/g,
+    /EAAAE[A-Za-z0-9]{50,}/g
+  ]
+};
+var SQUARE_OAUTH_SECRET = {
+  secretType: "SQUARE_OAUTH_SECRET",
+  patterns: [/sq0csp-[A-Za-z0-9_-]{43}/g]
+};
+var PAYPAL_CLIENT_SECRET = {
+  secretType: "PAYPAL_CLIENT_SECRET",
+  patterns: [/(?:PAYPAL_CLIENT_SECRET|PAYPAL_SECRET)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var PAYPAL_BRAINTREE_TOKEN = {
+  secretType: "PAYPAL_BRAINTREE_TOKEN",
+  patterns: [/access_token\$(?:production|sandbox)\$[a-z0-9]{16}\$[a-f0-9]{32}/g]
+};
+var BRAINTREE_KEY = {
+  secretType: "BRAINTREE_KEY",
+  patterns: [/(?:BRAINTREE_(?:PUBLIC|PRIVATE)_KEY)\s*[:=]\s*["']?([A-Za-z0-9]{32})["']?/g]
+};
+var ADYEN_API_KEY = {
+  secretType: "ADYEN_API_KEY",
+  patterns: [/(?:ADYEN_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9]{32,})["']?/g],
+  minEntropy: 3.5
+};
+var SHOPIFY_TOKEN = {
+  secretType: "SHOPIFY_TOKEN",
+  patterns: [
+    /shpat_[a-fA-F0-9]{32}/g,
+    /shpca_[a-fA-F0-9]{32}/g,
+    /shppa_[a-fA-F0-9]{32}/g,
+    /shpss_[a-fA-F0-9]{32}/g
+  ]
+};
+var PLAID_KEY = {
+  secretType: "PLAID_KEY",
+  patterns: [
+    /(?:PLAID_CLIENT_ID)\s*[:=]\s*["']?([a-f0-9]{24})["']?/g,
+    /(?:PLAID_SECRET)\s*[:=]\s*["']?([a-f0-9]{30})["']?/g,
+    /access-(?:sandbox|development|production)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/g
+  ]
+};
+var PAYMENT_PATTERNS = [
+  STRIPE_KEY,
+  STRIPE_WEBHOOK_SECRET,
+  SQUARE_ACCESS_TOKEN,
+  SQUARE_OAUTH_SECRET,
+  PAYPAL_CLIENT_SECRET,
+  PAYPAL_BRAINTREE_TOKEN,
+  BRAINTREE_KEY,
+  ADYEN_API_KEY,
+  SHOPIFY_TOKEN,
+  PLAID_KEY
+];
+
+// src/patterns/secrets/database.ts
+var DATABASE_CONNECTION_STRING = {
+  secretType: "DATABASE_CONNECTION_STRING",
+  patterns: [
+    /(?:postgres|postgresql|mysql|mongodb|redis|amqp|mssql):\/\/[^\s"']+/gi
+  ]
+};
+var MONGODB_SRV = {
+  secretType: "MONGODB_SRV",
+  patterns: [/mongodb\+srv:\/\/[^\s"']+/g]
+};
+var REDIS_URL_WITH_PASSWORD = {
+  secretType: "REDIS_URL_WITH_PASSWORD",
+  patterns: [/redis:\/\/:[^@\s]+@[^\s"']+/g]
+};
+var ELASTICSEARCH_URL = {
+  secretType: "ELASTICSEARCH_URL",
+  patterns: [/https?:\/\/[^:]+:[^@]+@[^/]*(?:elastic|es|elasticsearch)[^\s"']*/gi]
+};
+var FIREBASE_KEY = {
+  secretType: "FIREBASE_KEY",
+  patterns: [/(?:FIREBASE_API_KEY|FIREBASE_KEY)\s*[:=]\s*["']?(AIza[A-Za-z0-9_-]{35})["']?/g]
+};
+var FIREBASE_URL = {
+  secretType: "FIREBASE_URL",
+  patterns: [/https:\/\/[a-z0-9-]+\.firebaseio\.com/g]
+};
+var SUPABASE_KEY = {
+  secretType: "SUPABASE_KEY",
+  patterns: [
+    /(?:SUPABASE_KEY|SUPABASE_ANON_KEY|SUPABASE_SERVICE_KEY)\s*[:=]\s*["']?(eyJ[A-Za-z0-9_-]{100,})["']?/g
+  ]
+};
+var PLANETSCALE_TOKEN = {
+  secretType: "PLANETSCALE_TOKEN",
+  patterns: [/pscale_tkn_[A-Za-z0-9_-]{40,}/g]
+};
+var PLANETSCALE_PASSWORD = {
+  secretType: "PLANETSCALE_PASSWORD",
+  patterns: [/pscale_pw_[A-Za-z0-9_-]{40,}/g]
+};
+var COCKROACHDB_CONNECTION = {
+  secretType: "COCKROACHDB_CONNECTION",
+  patterns: [/(?:COCKROACH_URL|DATABASE_URL)\s*[:=]\s*["']?(postgresql:\/\/[^\s"']+\.cockroachlabs\.cloud[^\s"']*)["']?/g]
+};
+var NEON_DB_TOKEN = {
+  secretType: "NEON_DB_TOKEN",
+  patterns: [/(?:NEON_API_KEY|NEON_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var DATABASE_PATTERNS = [
+  DATABASE_CONNECTION_STRING,
+  MONGODB_SRV,
+  REDIS_URL_WITH_PASSWORD,
+  ELASTICSEARCH_URL,
+  FIREBASE_KEY,
+  FIREBASE_URL,
+  SUPABASE_KEY,
+  PLANETSCALE_TOKEN,
+  PLANETSCALE_PASSWORD,
+  COCKROACHDB_CONNECTION,
+  NEON_DB_TOKEN
+];
+
+// src/patterns/secrets/infrastructure.ts
+var DOCKER_HUB_TOKEN = {
+  secretType: "DOCKER_HUB_TOKEN",
+  patterns: [
+    /dckr_pat_[A-Za-z0-9_-]{27,}/g,
+    /(?:DOCKER_PASSWORD|DOCKERHUB_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{36,})["']?/g
+  ]
+};
+var DOCKER_REGISTRY_AUTH = {
+  secretType: "DOCKER_REGISTRY_AUTH",
+  patterns: [/"auth"\s*:\s*"([A-Za-z0-9+/=]{20,})"/g],
+  minEntropy: 3.5
+};
+var KUBERNETES_SERVICE_TOKEN = {
+  secretType: "KUBERNETES_SERVICE_TOKEN",
+  patterns: [/(?:KUBERNETES_TOKEN|K8S_TOKEN|KUBE_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{100,})["']?/g],
+  minEntropy: 4
+};
+var TERRAFORM_TOKEN = {
+  secretType: "TERRAFORM_TOKEN",
+  patterns: [
+    /[A-Za-z0-9]{14}\.atlasv1\.[A-Za-z0-9_-]{60,}/g,
+    /(?:TF_TOKEN|TFC_TOKEN|TERRAFORM_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9._-]{40,})["']?/g
+  ]
+};
+var VAULT_TOKEN = {
+  secretType: "VAULT_TOKEN",
+  patterns: [
+    /hvs\.[A-Za-z0-9_-]{24,}/g,
+    /(?:VAULT_TOKEN)\s*[:=]\s*["']?([a-z0-9.-]{20,})["']?/g
+  ]
+};
+var CONSUL_TOKEN = {
+  secretType: "CONSUL_TOKEN",
+  patterns: [/(?:CONSUL_TOKEN|CONSUL_HTTP_TOKEN)\s*[:=]\s*["']?([a-f0-9-]{36})["']?/g]
+};
+var PULUMI_TOKEN = {
+  secretType: "PULUMI_TOKEN",
+  patterns: [/pul-[A-Za-z0-9]{40}/g]
+};
+var ANSIBLE_VAULT_PASSWORD = {
+  secretType: "ANSIBLE_VAULT_PASSWORD",
+  patterns: [/\$ANSIBLE_VAULT;[0-9.]+;AES256/g]
+};
+var HELM_REPO_TOKEN = {
+  secretType: "HELM_REPO_TOKEN",
+  patterns: [/(?:HELM_REPO_PASSWORD|HELM_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{20,})["']?/g],
+  minEntropy: 3.5
+};
+var GRAFANA_API_KEY = {
+  secretType: "GRAFANA_API_KEY",
+  patterns: [
+    /eyJrIjoi[A-Za-z0-9_-]{30,}/g,
+    /glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}/g,
+    /glc_[A-Za-z0-9+/]{32,}={0,2}/g
+  ]
+};
+var INFRASTRUCTURE_PATTERNS = [
+  DOCKER_HUB_TOKEN,
+  DOCKER_REGISTRY_AUTH,
+  KUBERNETES_SERVICE_TOKEN,
+  TERRAFORM_TOKEN,
+  VAULT_TOKEN,
+  CONSUL_TOKEN,
+  PULUMI_TOKEN,
+  ANSIBLE_VAULT_PASSWORD,
+  HELM_REPO_TOKEN,
+  GRAFANA_API_KEY
+];
+
+// src/patterns/secrets/saas.ts
+var SALESFORCE_TOKEN = {
+  secretType: "SALESFORCE_TOKEN",
+  patterns: [/(?:SALESFORCE_TOKEN|SF_ACCESS_TOKEN|SFDC_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9!]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var HUBSPOT_API_KEY = {
+  secretType: "HUBSPOT_API_KEY",
+  patterns: [
+    /(?:HUBSPOT_API_KEY|HAPI_KEY)\s*[:=]\s*["']?([a-f0-9-]{36})["']?/g,
+    /pat-(?:na|eu)1-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/g
+  ]
+};
+var ZENDESK_TOKEN = {
+  secretType: "ZENDESK_TOKEN",
+  patterns: [/(?:ZENDESK_TOKEN|ZENDESK_API_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9]{40})["']?/g]
+};
+var DATADOG_API_KEY = {
+  secretType: "DATADOG_API_KEY",
+  patterns: [
+    /(?:DD_API_KEY|DATADOG_API_KEY)\s*[:=]\s*["']?([a-f0-9]{32})["']?/g,
+    /(?:DD_APP_KEY|DATADOG_APP_KEY)\s*[:=]\s*["']?([a-f0-9]{40})["']?/g
+  ]
+};
+var NEW_RELIC_KEY = {
+  secretType: "NEW_RELIC_KEY",
+  patterns: [
+    /NRAK-[A-Z0-9]{27}/g,
+    /(?:NEW_RELIC_LICENSE_KEY|NEWRELIC_KEY)\s*[:=]\s*["']?([a-f0-9]{40})["']?/g,
+    /NRII-[A-Za-z0-9_-]{32}/g,
+    /NRIQ-[A-Za-z0-9_-]{32}/g
+  ]
+};
+var PAGERDUTY_KEY = {
+  secretType: "PAGERDUTY_KEY",
+  patterns: [/(?:PAGERDUTY_TOKEN|PD_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_+-]{20})["']?/g]
+};
+var LAUNCHDARKLY_KEY = {
+  secretType: "LAUNCHDARKLY_KEY",
+  patterns: [
+    /(?:sdk|mob|api)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/g
+  ]
+};
+var SENTRY_DSN = {
+  secretType: "SENTRY_DSN",
+  patterns: [/https:\/\/[a-f0-9]{32}@[a-z0-9.]+\.ingest\.sentry\.io\/[0-9]+/g]
+};
+var SENTRY_AUTH_TOKEN = {
+  secretType: "SENTRY_AUTH_TOKEN",
+  patterns: [
+    /sntrys_[A-Za-z0-9]{60,}/g,
+    /(?:SENTRY_AUTH_TOKEN)\s*[:=]\s*["']?([a-f0-9]{64})["']?/g
+  ]
+};
+var SEGMENT_KEY = {
+  secretType: "SEGMENT_KEY",
+  patterns: [/(?:SEGMENT_WRITE_KEY|SEGMENT_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9]{32})["']?/g]
+};
+var AIRTABLE_KEY = {
+  secretType: "AIRTABLE_KEY",
+  patterns: [
+    /key[A-Za-z0-9]{14}/g,
+    /pat[A-Za-z0-9]{14}\.[a-f0-9]{64}/g
+  ]
+};
+var NOTION_TOKEN = {
+  secretType: "NOTION_TOKEN",
+  patterns: [
+    /secret_[A-Za-z0-9]{43}/g,
+    /ntn_[A-Za-z0-9]{40,}/g
+  ]
+};
+var ASANA_TOKEN = {
+  secretType: "ASANA_TOKEN",
+  patterns: [/(?:ASANA_TOKEN|ASANA_ACCESS_TOKEN)\s*[:=]\s*["']?([0-9]\/[0-9]{16}:[A-Za-z0-9]{32})["']?/g]
+};
+var JIRA_TOKEN = {
+  secretType: "JIRA_TOKEN",
+  patterns: [/(?:JIRA_TOKEN|JIRA_API_TOKEN|ATLASSIAN_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9]{24,})["']?/g],
+  minEntropy: 3.5
+};
+var LINEAR_API_KEY = {
+  secretType: "LINEAR_API_KEY",
+  patterns: [/lin_api_[A-Za-z0-9]{40}/g]
+};
+var CONTENTFUL_TOKEN = {
+  secretType: "CONTENTFUL_TOKEN",
+  patterns: [/(?:CONTENTFUL_ACCESS_TOKEN|CONTENTFUL_DELIVERY_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{43})["']?/g]
+};
+var ALGOLIA_KEY = {
+  secretType: "ALGOLIA_KEY",
+  patterns: [/(?:ALGOLIA_ADMIN_KEY|ALGOLIA_API_KEY)\s*[:=]\s*["']?([a-f0-9]{32})["']?/g]
+};
+var SAAS_PATTERNS = [
+  SALESFORCE_TOKEN,
+  HUBSPOT_API_KEY,
+  ZENDESK_TOKEN,
+  DATADOG_API_KEY,
+  NEW_RELIC_KEY,
+  PAGERDUTY_KEY,
+  LAUNCHDARKLY_KEY,
+  SENTRY_DSN,
+  SENTRY_AUTH_TOKEN,
+  SEGMENT_KEY,
+  AIRTABLE_KEY,
+  NOTION_TOKEN,
+  ASANA_TOKEN,
+  JIRA_TOKEN,
+  LINEAR_API_KEY,
+  CONTENTFUL_TOKEN,
+  ALGOLIA_KEY
+];
+
+// src/patterns/secrets/ai-ml.ts
+var OPENAI_KEY = {
+  secretType: "OPENAI_KEY",
+  patterns: [
+    /sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}/g,
+    /sk-proj-[A-Za-z0-9_-]{40,}/g,
+    /sk-[A-Za-z0-9_-]{40,}/g
+  ]
+};
+var ANTHROPIC_KEY = {
+  secretType: "ANTHROPIC_KEY",
+  patterns: [/sk-ant-[A-Za-z0-9_-]{40,}/g]
+};
+var COHERE_KEY = {
+  secretType: "COHERE_KEY",
+  patterns: [
+    /(?:COHERE_API_KEY|CO_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9]{40})["']?/g
+  ]
+};
+var HUGGINGFACE_TOKEN = {
+  secretType: "HUGGINGFACE_TOKEN",
+  patterns: [/hf_[A-Za-z0-9]{34}/g]
+};
+var REPLICATE_TOKEN = {
+  secretType: "REPLICATE_TOKEN",
+  patterns: [
+    /r8_[A-Za-z0-9]{37}/g,
+    /(?:REPLICATE_API_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{40})["']?/g
+  ]
+};
+var GOOGLE_AI_KEY = {
+  secretType: "GOOGLE_AI_KEY",
+  patterns: [/(?:GOOGLE_AI_KEY|GEMINI_API_KEY)\s*[:=]\s*["']?(AIza[A-Za-z0-9_-]{35})["']?/g]
+};
+var MISTRAL_KEY = {
+  secretType: "MISTRAL_KEY",
+  patterns: [/(?:MISTRAL_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9]{32})["']?/g]
+};
+var PINECONE_KEY = {
+  secretType: "PINECONE_KEY",
+  patterns: [/(?:PINECONE_API_KEY)\s*[:=]\s*["']?([a-f0-9-]{36})["']?/g]
+};
+var WEAVIATE_KEY = {
+  secretType: "WEAVIATE_KEY",
+  patterns: [/(?:WEAVIATE_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var WANDB_KEY = {
+  secretType: "WANDB_KEY",
+  patterns: [/(?:WANDB_API_KEY)\s*[:=]\s*["']?([a-f0-9]{40})["']?/g]
+};
+var DEEPSEEK_KEY = {
+  secretType: "DEEPSEEK_KEY",
+  patterns: [/(?:DEEPSEEK_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var GROQ_KEY = {
+  secretType: "GROQ_KEY",
+  patterns: [/gsk_[A-Za-z0-9]{52}/g]
+};
+var AI_ML_PATTERNS = [
+  OPENAI_KEY,
+  ANTHROPIC_KEY,
+  COHERE_KEY,
+  HUGGINGFACE_TOKEN,
+  REPLICATE_TOKEN,
+  GOOGLE_AI_KEY,
+  MISTRAL_KEY,
+  PINECONE_KEY,
+  WEAVIATE_KEY,
+  WANDB_KEY,
+  DEEPSEEK_KEY,
+  GROQ_KEY
+];
+
+// src/patterns/secrets/auth.ts
+var AUTH0_CLIENT_SECRET = {
+  secretType: "AUTH0_CLIENT_SECRET",
+  patterns: [/(?:AUTH0_CLIENT_SECRET)\s*[:=]\s*["']?([A-Za-z0-9_-]{32,})["']?/g],
+  minEntropy: 3.5
+};
+var AUTH0_MANAGEMENT_TOKEN = {
+  secretType: "AUTH0_MANAGEMENT_TOKEN",
+  patterns: [/(?:AUTH0_MANAGEMENT_API_TOKEN|AUTH0_TOKEN)\s*[:=]\s*["']?(eyJ[A-Za-z0-9_-]{100,})["']?/g]
+};
+var OKTA_TOKEN = {
+  secretType: "OKTA_TOKEN",
+  patterns: [
+    /(?:OKTA_TOKEN|OKTA_API_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{42})["']?/g,
+    /00[A-Za-z0-9_-]{40}/g
+  ]
+};
+var CLERK_SECRET_KEY = {
+  secretType: "CLERK_SECRET_KEY",
+  patterns: [/sk_(?:live|test)_[A-Za-z0-9]{24,}/g]
+};
+var CLERK_PUBLISHABLE_KEY = {
+  secretType: "CLERK_PUBLISHABLE_KEY",
+  patterns: [/pk_(?:live|test)_[A-Za-z0-9]{24,}/g]
+};
+var FIREBASE_AUTH_KEY = {
+  secretType: "FIREBASE_AUTH_KEY",
+  patterns: [/(?:FIREBASE_AUTH_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{100,})["']?/g],
+  minEntropy: 4
+};
+var SUPABASE_SERVICE_KEY = {
+  secretType: "SUPABASE_SERVICE_KEY",
+  patterns: [/(?:SUPABASE_SERVICE_ROLE_KEY)\s*[:=]\s*["']?(eyJ[A-Za-z0-9_-]{100,})["']?/g]
+};
+var STYTCH_SECRET = {
+  secretType: "STYTCH_SECRET",
+  patterns: [/secret-(?:live|test)-[A-Za-z0-9_-]{36,}/g]
+};
+var PROPELAUTH_KEY = {
+  secretType: "PROPELAUTH_KEY",
+  patterns: [/(?:PROPELAUTH_API_KEY)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var KEYCLOAK_SECRET = {
+  secretType: "KEYCLOAK_SECRET",
+  patterns: [/(?:KEYCLOAK_CLIENT_SECRET|KC_CLIENT_SECRET)\s*[:=]\s*["']?([A-Za-z0-9-]{36})["']?/g]
+};
+var AUTH_PATTERNS = [
+  AUTH0_CLIENT_SECRET,
+  AUTH0_MANAGEMENT_TOKEN,
+  OKTA_TOKEN,
+  CLERK_SECRET_KEY,
+  CLERK_PUBLISHABLE_KEY,
+  FIREBASE_AUTH_KEY,
+  SUPABASE_SERVICE_KEY,
+  STYTCH_SECRET,
+  PROPELAUTH_KEY,
+  KEYCLOAK_SECRET
+];
+
+// src/patterns/secrets/cdn-hosting.ts
+var CLOUDFLARE_API_KEY = {
+  secretType: "CLOUDFLARE_API_KEY",
+  patterns: [
+    /(?:CLOUDFLARE_API_KEY|CF_API_KEY)\s*[:=]\s*["']?([a-f0-9]{37})["']?/g,
+    /(?:CLOUDFLARE_API_TOKEN|CF_API_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{40})["']?/g
+  ]
+};
+var CLOUDFLARE_CA_KEY = {
+  secretType: "CLOUDFLARE_CA_KEY",
+  patterns: [/v1\.0-[a-f0-9]{24}-[a-f0-9]{146}/g]
+};
+var FASTLY_API_KEY = {
+  secretType: "FASTLY_API_KEY",
+  patterns: [/(?:FASTLY_API_TOKEN|FASTLY_KEY)\s*[:=]\s*["']?([A-Za-z0-9_-]{32})["']?/g]
+};
+var NETLIFY_TOKEN = {
+  secretType: "NETLIFY_TOKEN",
+  patterns: [/(?:NETLIFY_AUTH_TOKEN|NETLIFY_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var VERCEL_TOKEN = {
+  secretType: "VERCEL_TOKEN",
+  patterns: [/(?:VERCEL_TOKEN|NOW_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9]{24})["']?/g]
+};
+var HEROKU_API_KEY = {
+  secretType: "HEROKU_API_KEY",
+  patterns: [
+    /(?:HEROKU_API_KEY)\s*[:=]\s*["']?([a-f0-9-]{36})["']?/g,
+    /[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/g
+  ]
+};
+var RENDER_TOKEN = {
+  secretType: "RENDER_TOKEN",
+  patterns: [/rnd_[A-Za-z0-9]{32,}/g]
+};
+var FLY_IO_TOKEN = {
+  secretType: "FLY_IO_TOKEN",
+  patterns: [/(?:FLY_ACCESS_TOKEN|FLY_API_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var RAILWAY_TOKEN = {
+  secretType: "RAILWAY_TOKEN",
+  patterns: [/(?:RAILWAY_TOKEN)\s*[:=]\s*["']?([a-f0-9-]{36})["']?/g]
+};
+var SURGE_TOKEN = {
+  secretType: "SURGE_TOKEN",
+  patterns: [/(?:SURGE_TOKEN|SURGE_LOGIN)\s*[:=]\s*["']?([A-Za-z0-9._-]{20,})["']?/g],
+  minEntropy: 3.5
+};
+var CDN_HOSTING_PATTERNS = [
+  CLOUDFLARE_API_KEY,
+  CLOUDFLARE_CA_KEY,
+  FASTLY_API_KEY,
+  NETLIFY_TOKEN,
+  VERCEL_TOKEN,
+  HEROKU_API_KEY,
+  RENDER_TOKEN,
+  FLY_IO_TOKEN,
+  RAILWAY_TOKEN,
+  SURGE_TOKEN
+];
+
+// src/patterns/secrets/social.ts
+var TWITTER_API_KEY = {
+  secretType: "TWITTER_API_KEY",
+  patterns: [
+    /(?:TWITTER_API_KEY|TWITTER_CONSUMER_KEY)\s*[:=]\s*["']?([A-Za-z0-9]{25})["']?/g
+  ]
+};
+var TWITTER_API_SECRET = {
+  secretType: "TWITTER_API_SECRET",
+  patterns: [
+    /(?:TWITTER_API_SECRET|TWITTER_CONSUMER_SECRET)\s*[:=]\s*["']?([A-Za-z0-9]{50})["']?/g
+  ]
+};
+var TWITTER_BEARER_TOKEN = {
+  secretType: "TWITTER_BEARER_TOKEN",
+  patterns: [/AAAAAAAAAAAAAAAAAAA[A-Za-z0-9%]{30,}/g]
+};
+var FACEBOOK_TOKEN = {
+  secretType: "FACEBOOK_TOKEN",
+  patterns: [
+    /EAA[A-Za-z0-9]{100,}/g,
+    /(?:FACEBOOK_TOKEN|FB_ACCESS_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9|_-]{40,})["']?/g
+  ]
+};
+var FACEBOOK_SECRET = {
+  secretType: "FACEBOOK_SECRET",
+  patterns: [/(?:FACEBOOK_SECRET|FB_APP_SECRET)\s*[:=]\s*["']?([a-f0-9]{32})["']?/g]
+};
+var INSTAGRAM_TOKEN = {
+  secretType: "INSTAGRAM_TOKEN",
+  patterns: [/(?:INSTAGRAM_TOKEN|IG_ACCESS_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9.]{100,})["']?/g],
+  minEntropy: 3.5
+};
+var LINKEDIN_SECRET = {
+  secretType: "LINKEDIN_SECRET",
+  patterns: [/(?:LINKEDIN_CLIENT_SECRET|LINKEDIN_SECRET)\s*[:=]\s*["']?([A-Za-z0-9]{16})["']?/g]
+};
+var YOUTUBE_API_KEY = {
+  secretType: "YOUTUBE_API_KEY",
+  patterns: [/(?:YOUTUBE_API_KEY)\s*[:=]\s*["']?(AIza[A-Za-z0-9_-]{35})["']?/g]
+};
+var TIKTOK_TOKEN = {
+  secretType: "TIKTOK_TOKEN",
+  patterns: [/(?:TIKTOK_TOKEN|TIKTOK_ACCESS_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9._-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var PINTEREST_TOKEN = {
+  secretType: "PINTEREST_TOKEN",
+  patterns: [/(?:PINTEREST_TOKEN|PINTEREST_ACCESS_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{40,})["']?/g],
+  minEntropy: 3.5
+};
+var SOCIAL_PATTERNS = [
+  TWITTER_API_KEY,
+  TWITTER_API_SECRET,
+  TWITTER_BEARER_TOKEN,
+  FACEBOOK_TOKEN,
+  FACEBOOK_SECRET,
+  INSTAGRAM_TOKEN,
+  LINKEDIN_SECRET,
+  YOUTUBE_API_KEY,
+  TIKTOK_TOKEN,
+  PINTEREST_TOKEN
+];
+
+// src/patterns/secrets/generic.ts
+var JWT_TOKEN = {
+  secretType: "JWT_TOKEN",
+  patterns: [
+    /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+  ]
+};
+var PRIVATE_KEY = {
+  secretType: "PRIVATE_KEY",
+  patterns: [
+    /-----BEGIN (?:RSA |EC |ED25519 |OPENSSH |DSA |PGP )?PRIVATE KEY(?: BLOCK)?-----/g
+  ]
+};
+var NPM_TOKEN = {
+  secretType: "NPM_TOKEN",
+  patterns: [
+    /npm_[A-Za-z0-9]{36}/g,
+    /\/\/registry\.npmjs\.org\/:_authToken=[A-Za-z0-9-]+/g
+  ]
+};
+var PYPI_TOKEN = {
+  secretType: "PYPI_TOKEN",
+  patterns: [/pypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}/g]
+};
+var RUBYGEMS_KEY = {
+  secretType: "RUBYGEMS_KEY",
+  patterns: [/rubygems_[a-f0-9]{48}/g]
+};
+var NUGET_KEY = {
+  secretType: "NUGET_KEY",
+  patterns: [/oy2[A-Za-z0-9]{43}/g]
+};
+var CRATES_IO_TOKEN = {
+  secretType: "CRATES_IO_TOKEN",
+  patterns: [/cio[A-Za-z0-9]{32}/g]
+};
+var GENERIC_HIGH_ENTROPY = {
+  secretType: "GENERIC_SECRET",
+  patterns: [
+    /(?:api[_-]?key|secret|token|password|passwd|credential|auth)[_\s]*[:=]\s*["']([A-Za-z0-9+/=_\-]{16,})["']/gi
+  ],
+  minEntropy: 3.5
+};
+var GENERIC_BEARER_TOKEN = {
+  secretType: "BEARER_TOKEN",
+  patterns: [
+    /(?:Authorization|Bearer)\s*[:=]\s*["']?Bearer\s+([A-Za-z0-9._~+/=-]{20,})["']?/g
+  ],
+  minEntropy: 3.5
+};
+var BASIC_AUTH_HEADER = {
+  secretType: "BASIC_AUTH",
+  patterns: [
+    /(?:Authorization)\s*[:=]\s*["']?Basic\s+([A-Za-z0-9+/=]{20,})["']?/g
+  ]
+};
+var GENERIC_PATTERNS2 = [
+  JWT_TOKEN,
+  PRIVATE_KEY,
+  NPM_TOKEN,
+  PYPI_TOKEN,
+  RUBYGEMS_KEY,
+  NUGET_KEY,
+  CRATES_IO_TOKEN,
+  GENERIC_HIGH_ENTROPY,
+  GENERIC_BEARER_TOKEN,
+  BASIC_AUTH_HEADER
+];
+
+// src/patterns/secrets/index.ts
+var ALL_SECRET_PATTERNS = [
+  ...CLOUD_PATTERNS,
+  ...SOURCE_CONTROL_PATTERNS,
+  ...CICD_PATTERNS,
+  ...COMMUNICATION_PATTERNS,
+  ...PAYMENT_PATTERNS,
+  ...DATABASE_PATTERNS,
+  ...INFRASTRUCTURE_PATTERNS,
+  ...SAAS_PATTERNS,
+  ...AI_ML_PATTERNS,
+  ...AUTH_PATTERNS,
+  ...CDN_HOSTING_PATTERNS,
+  ...SOCIAL_PATTERNS,
+  ...GENERIC_PATTERNS2
+];
+
+// src/guards/secret.guard.ts
+var SecretGuard = class extends BaseGuard {
+  name = "secret";
+  patterns;
+  constructor(options) {
+    super();
+    let patterns = ALL_SECRET_PATTERNS;
+    if (options?.secretTypes && options.secretTypes.length > 0) {
+      const allowed = new Set(options.secretTypes);
+      patterns = patterns.filter((p) => allowed.has(p.secretType));
+    }
+    this.patterns = patterns;
+  }
+  async analyze(text, config) {
+    const cfg = this.mergeConfig(config);
+    const detections = [];
+    for (const pattern of this.patterns) {
+      for (const regex of pattern.patterns) {
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(text)) !== null) {
+          const matchText = match[1] ?? match[0];
+          const fullMatch = match[0];
+          const start = match.index;
+          const end = start + fullMatch.length;
+          if (pattern.validate && !pattern.validate(matchText)) {
+            continue;
+          }
+          if (pattern.minEntropy) {
+            const entropy = shannonEntropy(matchText);
+            if (entropy < pattern.minEntropy) {
+              continue;
+            }
+          }
+          detections.push(
+            this.makeDetection(text, {
+              entityType: pattern.secretType,
+              start,
+              end,
+              text: fullMatch,
+              confidence: "high",
+              score: 0.9,
+              guardName: this.name
+            })
+          );
+        }
+      }
+    }
+    return this.buildResult(text, detections, cfg.mode);
+  }
+};
+
+// src/patterns/injection.ts
+var INJECTION_PATTERNS = [
+  /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|prompts?|commands?|directives?)/i,
+  /disregard\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|prompts?|commands?)/i,
+  /forget\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|prompts?|commands?)/i,
+  /override\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|prompts?|commands?)/i,
+  /you\s+are\s+now\s+(?:a|an|in)\s+/i,
+  /new\s+instructions?\s*:/i,
+  /system\s*:\s*/i,
+  /\bDAN\s+mode\b/i,
+  /\bjailbreak\b/i,
+  /do\s+anything\s+now/i,
+  /act\s+as\s+(?:if\s+)?(?:you\s+(?:are|were)\s+)?(?:a\s+)?/i,
+  /pretend\s+(?:you\s+are|to\s+be)\s+/i,
+  /(?:reveal|show|display|print|output)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions?)/i,
+  /(?:what|repeat|tell\s+me)\s+(?:are\s+)?your\s+(?:system\s+)?(?:instructions?|prompt|rules?)/i,
+  /bypass\s+(?:your\s+)?(?:safety|security|content|ethical)\s+(?:filters?|guidelines?|restrictions?|rules?)/i,
+  /(?:from\s+now\s+on|starting\s+now|henceforth)\s*,?\s*(?:you\s+(?:will|shall|must|should))/i
+];
+var INJECTION_KEYWORDS = [
+  "ignore previous instructions",
+  "disregard all prior instructions",
+  "forget your instructions",
+  "override system prompt",
+  "you are now a",
+  "new instructions",
+  "jailbreak",
+  "DAN mode",
+  "do anything now",
+  "bypass safety filters",
+  "ignore content policy",
+  "pretend you are",
+  "act as if you were",
+  "reveal your system prompt",
+  "what are your instructions",
+  "from now on you will",
+  "ignore all restrictions",
+  "developer mode",
+  "sudo mode",
+  "admin override",
+  "unlock hidden features",
+  "disable safety mode",
+  "ignore ethical guidelines",
+  "forget all rules",
+  "you have no restrictions"
+];
+var LEAKAGE_PATTERNS = [
+  /(?:reveal|show|display|print|output|repeat|echo)\s+(?:the\s+)?(?:system\s+)?(?:prompt|instructions?)/i,
+  /(?:what|tell\s+me|share)\s+(?:is\s+|are\s+)?(?:the\s+|your\s+)?(?:system\s+)?(?:prompt|instructions?|initial\s+message)/i,
+  /(?:beginning|start|first\s+part)\s+of\s+(?:the\s+|your\s+)?(?:conversation|prompt|message)/i,
+  /(?:copy|paste|reproduce)\s+(?:the\s+)?(?:text|content)\s+(?:above|before)/i,
+  /(?:text|content|message)\s+(?:before|above|preceding)\s+(?:this|my)\s+(?:message|input)/i,
+  /(?:everything|all)\s+(?:before|above|prior\s+to)\s+(?:this|my\s+message)/i,
+  /repeat\s+(?:everything|all|the\s+text)\s+(?:above|before|I\s+said)/i
+];
+var LEAKAGE_KEYWORDS = [
+  "reveal system prompt",
+  "show me your instructions",
+  "what is your system prompt",
+  "display initial message",
+  "repeat everything above",
+  "copy text before my message",
+  "what are your instructions",
+  "print your prompt",
+  "output your system message",
+  "beginning of conversation",
+  "share your initial instructions"
+];
+
+// src/guards/injection.guard.ts
+var import_string_similarity = require("string-similarity");
+var InjectionGuard = class extends BaseGuard {
+  name = "injection";
+  async analyze(text, config) {
+    const cfg = this.mergeConfig({ threshold: 0.6, mode: "block", ...config });
+    const detections = [];
+    for (const pattern of INJECTION_PATTERNS) {
+      const re = new RegExp(pattern.source, pattern.flags + "g");
+      let match;
+      while ((match = re.exec(text)) !== null) {
+        detections.push(
+          this.makeDetection(text, {
+            entityType: "PROMPT_INJECTION",
+            start: match.index,
+            end: match.index + match[0].length,
+            text: match[0],
+            confidence: "high",
+            score: 0.9,
+            guardName: this.name
+          })
+        );
+      }
+    }
+    if (detections.length === 0) {
+      const score = this.heuristicScore(text);
+      if (score >= cfg.threshold) {
+        detections.push(
+          this.makeDetection(text, {
+            entityType: "PROMPT_INJECTION",
+            start: 0,
+            end: text.length,
+            text: text.slice(0, 200),
+            confidence: score >= 0.8 ? "high" : "medium",
+            score,
+            guardName: this.name
+          })
+        );
+      }
+    }
+    return this.buildResult(text, detections, cfg.mode);
+  }
+  heuristicScore(text) {
+    const normalized = text.toLowerCase().trim();
+    if (normalized.length === 0 || INJECTION_KEYWORDS.length === 0) return 0;
+    const result = (0, import_string_similarity.findBestMatch)(normalized, INJECTION_KEYWORDS);
+    let bestScore = result.bestMatch.rating;
+    if (normalized.length > 100) {
+      const windowSize = 80;
+      const step = 30;
+      for (let i = 0; i <= normalized.length - windowSize; i += step) {
+        const window = normalized.slice(i, i + windowSize);
+        const windowResult = (0, import_string_similarity.findBestMatch)(window, INJECTION_KEYWORDS);
+        bestScore = Math.max(bestScore, windowResult.bestMatch.rating);
+      }
+    }
+    return bestScore;
+  }
+};
+
+// src/guards/leakage.guard.ts
+var import_string_similarity2 = require("string-similarity");
+var LeakageGuard = class extends BaseGuard {
+  name = "leakage";
+  async analyze(text, config) {
+    const cfg = this.mergeConfig({ threshold: 0.6, mode: "block", ...config });
+    const detections = [];
+    for (const pattern of LEAKAGE_PATTERNS) {
+      const re = new RegExp(pattern.source, pattern.flags + "g");
+      let match;
+      while ((match = re.exec(text)) !== null) {
+        detections.push(
+          this.makeDetection(text, {
+            entityType: "PROMPT_LEAKAGE",
+            start: match.index,
+            end: match.index + match[0].length,
+            text: match[0],
+            confidence: "high",
+            score: 0.9,
+            guardName: this.name
+          })
+        );
+      }
+    }
+    if (detections.length === 0) {
+      const normalized = text.toLowerCase().trim();
+      if (normalized.length > 0 && LEAKAGE_KEYWORDS.length > 0) {
+        const result = (0, import_string_similarity2.findBestMatch)(normalized, LEAKAGE_KEYWORDS);
+        const score = result.bestMatch.rating;
+        if (score >= cfg.threshold) {
+          detections.push(
+            this.makeDetection(text, {
+              entityType: "PROMPT_LEAKAGE",
+              start: 0,
+              end: text.length,
+              text: text.slice(0, 200),
+              confidence: score >= 0.8 ? "high" : "medium",
+              score,
+              guardName: this.name
+            })
+          );
+        }
+      }
+    }
+    return this.buildResult(text, detections, cfg.mode);
+  }
+};
+
+// src/guards/testdata.guard.ts
+var SYNTHETIC_GUID_KEYWORDS = /\b[0-9a-f]{8}-(?:eval|test|demo|mock|fake|sample|exam|plac)[0-9a-f-]*\b/gi;
+var ZERO_PADDED_GUID = /\b0{8}-[0-9a-f]{4}-[0-9a-f]{4}-0{4}-0{12}\b/gi;
+var TEST_CREDIT_CARDS = [
+  "4111111111111111",
+  // Visa test
+  "4242424242424242",
+  // Stripe Visa
+  "5500000000000004",
+  // Mastercard test
+  "5555555555554444",
+  // Stripe Mastercard
+  "378282246310005",
+  // Amex test
+  "371449635398431",
+  // Amex test
+  "6011111111111117",
+  // Discover test
+  "3056930009020004",
+  // Diners test
+  "3566002020360505",
+  // JCB test
+  "4000056655665556"
+  // Stripe debit
+];
+var TEST_SSNS = [
+  "000-00-0000",
+  "123-45-6789",
+  "078-05-1120",
+  // Woolworth wallet card SSN (famous invalid)
+  "219-09-9999"
+  // Social Security ad SSN
+];
+var TEST_DATA_PATTERNS = [
+  {
+    entityType: "TEST_DATA_GUID",
+    patterns: [SYNTHETIC_GUID_KEYWORDS, ZERO_PADDED_GUID],
+    reason: "synthetic-guid"
+  },
+  {
+    entityType: "TEST_DATA_CREDIT_CARD",
+    patterns: TEST_CREDIT_CARDS.map(
+      (num) => new RegExp(`\\b${num}\\b`, "g")
+    ),
+    reason: "test-credit-card"
+  },
+  {
+    entityType: "TEST_DATA_SSN",
+    patterns: TEST_SSNS.map(
+      // Require dashes or spaces between SSN groups (not embedded in other numbers)
+      (ssn) => new RegExp(`\\b${ssn.replace(/-/g, "[\\s-]")}\\b`, "g")
+    ),
+    reason: "test-ssn"
+  },
+  {
+    entityType: "TEST_DATA_EMAIL",
+    patterns: [
+      /\b[\w.+-]+@(?:example\.(?:com|org|net)|test\.com|mailinator\.com|tempmail\.com)\b/gi,
+      /\bnoreply@[^\s]+\b/gi
+    ],
+    reason: "placeholder-email"
+  },
+  {
+    entityType: "TEST_DATA_PHONE",
+    patterns: [
+      /\b(?:\+?1[-.\s]?)?(?:\()?555[-.\s]?01[0-9]{2}(?:\))?[-.\s]?\d{4}\b/g
+      // 555-01xx range (reserved fictional)
+    ],
+    reason: "fictional-phone"
+  },
+  {
+    entityType: "TEST_DATA_SEQUENTIAL",
+    patterns: [
+      /\b[A]{4,}0{6,}[0-9A-F]{1,4}\b/gi,
+      // AAAA000000000001 pattern
+      /\b1234567890abcdef\b/gi
+      // Classic sequential hex (exact)
+    ],
+    reason: "sequential-pattern"
+  }
+];
+var TestDataGuard = class extends BaseGuard {
+  name = "testdata";
+  async analyze(text, config) {
+    const cfg = this.mergeConfig(config);
+    const detections = [];
+    for (const pattern of TEST_DATA_PATTERNS) {
+      for (const regex of pattern.patterns) {
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(text)) !== null) {
+          const matchText = match[0];
+          const start = match.index;
+          const end = start + matchText.length;
+          detections.push(
+            this.makeDetection(
+              text,
+              {
+                entityType: pattern.entityType,
+                start,
+                end,
+                text: matchText,
+                confidence: "high",
+                score: 0.95,
+                guardName: this.name
+              },
+              "regex",
+              "informational"
+            )
+          );
+        }
+      }
+    }
+    const deduped = this.deduplicateDetections(detections);
+    return this.buildInformationalResult(text, deduped);
+  }
+  /** Build a result that always passes — test data is informational, not blocking */
+  buildInformationalResult(text, detections) {
+    const score = detections.length > 0 ? Math.max(...detections.map((d) => d.score)) : 0;
+    const types = [...new Set(detections.map((d) => d.entityType))];
+    return {
+      passed: true,
+      // Always passes — informational only
+      reason: detections.length === 0 ? "No test data detected" : `Test data detected: ${types.join(", ")}`,
+      guardName: this.name,
+      score,
+      detections
+    };
+  }
+  deduplicateDetections(detections) {
+    if (detections.length <= 1) return detections;
+    const sorted = [...detections].sort((a, b) => b.score - a.score);
+    const result = [];
+    for (const detection of sorted) {
+      const overlaps = result.some(
+        (existing) => detection.start < existing.end && detection.end > existing.start
+      );
+      if (!overlaps) {
+        result.push(detection);
+      }
+    }
+    return result.sort((a, b) => a.start - b.start);
+  }
+};
+
+// src/policy/presets.ts
+var STRICT = {
+  name: "strict",
+  description: "Maximum sensitivity \u2014 flags all detectable PII, secrets, injection, and test data at low confidence thresholds",
+  guards: {
+    pii: { enabled: true, threshold: 0.3, mode: "block" },
+    secret: { enabled: true, threshold: 0.5, mode: "block" },
+    injection: { enabled: true, threshold: 0.5, mode: "block" },
+    leakage: { enabled: true, threshold: 0.5, mode: "block" }
+  },
+  riskThresholds: { critical: 0.9, high: 0.7, medium: 0.5, low: 0.3 },
+  testDataDetection: "flag"
+};
+var MODERATE = {
+  name: "moderate",
+  description: "Balanced sensitivity \u2014 flags high-confidence PII and secrets, redacts rather than blocks",
+  guards: {
+    pii: { enabled: true, threshold: 0.5, mode: "redact" },
+    secret: { enabled: true, threshold: 0.7, mode: "redact" },
+    injection: { enabled: true, threshold: 0.6, mode: "block" },
+    leakage: { enabled: true, threshold: 0.6, mode: "block" }
+  },
+  riskThresholds: { critical: 0.9, high: 0.8, medium: 0.65, low: 0.5 },
+  testDataDetection: "flag"
+};
+var BUILTIN_POLICIES = {
+  strict: STRICT,
+  moderate: MODERATE
+};
+function getPolicy(name) {
+  const policy = BUILTIN_POLICIES[name];
+  if (!policy) {
+    const available = Object.keys(BUILTIN_POLICIES).join(", ");
+    throw new Error(
+      `Unknown policy "${name}". Available: ${available}`
+    );
+  }
+  return policy;
+}
+
+// src/policy/resolve.ts
+function resolveRef(ref) {
+  return typeof ref === "string" ? getPolicy(ref) : ref;
+}
+function resolvePolicy(base, ...overlays) {
+  let result = structuredClone(resolveRef(base));
+  for (const overlay of overlays) {
+    const o = resolveRef(overlay);
+    result = mergePolicies(result, o);
+  }
+  return result;
+}
+function mergePolicies(base, overlay) {
+  const result = structuredClone(base);
+  result.name = `${base.name}+${overlay.name}`;
+  result.description = `${base.description} | ${overlay.description}`;
+  for (const guardName of ["pii", "secret", "injection", "leakage"]) {
+    const baseGuard = base.guards[guardName];
+    const overlayGuard = overlay.guards[guardName];
+    if (!overlayGuard) continue;
+    if (!baseGuard) {
+      result.guards[guardName] = structuredClone(overlayGuard);
+      continue;
+    }
+    result.guards[guardName] = mergeGuardConfig(baseGuard, overlayGuard);
+  }
+  if (overlay.riskThresholds) {
+    result.riskThresholds = {
+      critical: Math.min(
+        base.riskThresholds.critical,
+        overlay.riskThresholds.critical
+      ),
+      high: Math.min(base.riskThresholds.high, overlay.riskThresholds.high),
+      medium: Math.min(
+        base.riskThresholds.medium,
+        overlay.riskThresholds.medium
+      ),
+      low: Math.min(base.riskThresholds.low, overlay.riskThresholds.low)
+    };
+  }
+  if (overlay.testDataDetection) {
+    result.testDataDetection = overlay.testDataDetection;
+  }
+  return result;
+}
+function mergeGuardConfig(base, overlay) {
+  const result = { ...base };
+  if (overlay.enabled !== void 0) {
+    result.enabled = overlay.enabled;
+  }
+  if (overlay.threshold !== void 0) {
+    result.threshold = base.threshold !== void 0 ? Math.min(base.threshold, overlay.threshold) : overlay.threshold;
+  }
+  if (overlay.mode !== void 0) {
+    if (overlay.mode === "block" || base.mode === "block") {
+      result.mode = "block";
+    } else {
+      result.mode = overlay.mode;
+    }
+  }
+  if (overlay.entityTypes) {
+    if (base.entityTypes && base.entityTypes.length > 0) {
+      const overlaySet = new Set(overlay.entityTypes);
+      result.entityTypes = base.entityTypes.filter((t) => overlaySet.has(t));
+    } else {
+      result.entityTypes = [...overlay.entityTypes];
+    }
+  }
+  if (overlay.secretTypes) {
+    if (base.secretTypes && base.secretTypes.length > 0) {
+      const overlaySet = new Set(overlay.secretTypes);
+      result.secretTypes = base.secretTypes.filter((t) => overlaySet.has(t));
+    } else {
+      result.secretTypes = [...overlay.secretTypes];
+    }
+  }
+  return result;
+}
+function policyToEngineConfig(policy) {
+  const pii = policy.guards.pii ?? {};
+  const secret = policy.guards.secret ?? {};
+  const injection = policy.guards.injection ?? {};
+  const leakage = policy.guards.leakage ?? {};
+  return {
+    piiOptions: {
+      entityTypes: pii.entityTypes
+    },
+    secretOptions: {
+      secretTypes: secret.secretTypes
+    },
+    guardConfigs: {
+      pii: { threshold: pii.threshold, mode: pii.mode },
+      secret: { threshold: secret.threshold, mode: secret.mode },
+      injection: { threshold: injection.threshold, mode: injection.mode },
+      leakage: { threshold: leakage.threshold, mode: leakage.mode }
+    }
+  };
+}
+
+// src/index.ts
+var DEFAULT_CONFIG2 = {
+  enabled: true,
+  debounceMs: 500,
+  guards: {
+    pii: { enabled: true },
+    secret: { enabled: true },
+    injection: { enabled: true },
+    contentSafety: { enabled: false }
+  },
+  cascade: {
+    escalationThreshold: 0.75,
+    contextSentences: 3,
+    modelEnabled: false,
+    modelId: "Xenova/bert-base-NER"
+  }
+};
+function createEngine(config = DEFAULT_CONFIG2) {
+  const engine = new GuardrailsEngine();
+  if (config.policy) {
+    let policy = resolveRef(config.policy);
+    if (config.policyOverlays && config.policyOverlays.length > 0) {
+      policy = resolvePolicy(policy, ...config.policyOverlays);
+    }
+    const { piiOptions, secretOptions, guardConfigs } = policyToEngineConfig(policy);
+    if (policy.guards.pii?.enabled !== false) {
+      engine.addGuard(new PiiGuard(piiOptions));
+    }
+    if (policy.guards.secret?.enabled !== false) {
+      engine.addGuard(new SecretGuard(secretOptions));
+    }
+    if (policy.guards.injection?.enabled !== false) {
+      engine.addGuard(new InjectionGuard());
+      engine.addGuard(new LeakageGuard());
+    }
+    if (policy.testDataDetection !== "ignore") {
+      engine.addGuard(new TestDataGuard());
+    }
+    engine.updateConfig({ guards: guardConfigs });
+  } else {
+    if (config.guards.pii.enabled) {
+      engine.addGuard(new PiiGuard());
+    }
+    if (config.guards.secret.enabled) {
+      engine.addGuard(new SecretGuard());
+    }
+    if (config.guards.injection.enabled) {
+      engine.addGuard(new InjectionGuard());
+      engine.addGuard(new LeakageGuard());
+    }
+  }
+  if (config.cascade.modelEnabled) {
+    engine.initCascade({
+      bertEnabled: true,
+      llmEnabled: config.guards.contentSafety.enabled,
+      escalationThreshold: config.cascade.escalationThreshold,
+      contextSentences: config.cascade.contextSentences,
+      modelId: config.cascade.modelId
+    });
+  }
+  return engine;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BUILTIN_POLICIES,
+  BaseGuard,
+  DEFAULT_CONFIG,
+  GuardrailsEngine,
+  InjectionGuard,
+  LeakageGuard,
+  PiiGuard,
+  SecretGuard,
+  TestDataGuard,
+  assessRisk,
+  createEngine,
+  getPolicy,
+  policyToEngineConfig,
+  resolvePolicy
+});
+//# sourceMappingURL=index.js.map